ublubu commented on issue #1236: URL: https://github.com/apache/iceberg-rust/issues/1236#issuecomment-4804352688
Hey, I had a look at the prior art catalogued in #2311, and I really like the `Authenticator` trait idea from #2088. Over at [MaterializeInc/materialize](https://github.com/MaterializeInc/materialize), we've already been using `iceberg-rust` with AWS SigV4 for S3 Tables (and `gcp_auth` for Google's BigLake) using that technique. The main difference is that, while the trait lives in our `iceberg-rust` fork, the AWS/GCP-specific authenticators are implemented in our home repo, `materialize`. SigV4 Authenticator: - https://github.com/MaterializeInc/materialize/blob/5066cda9bb06ac726a999c3d9f12f199e9673f75/src/storage-types/src/connections.rs#L145-L246 GCP Authenticator _([Bearer Token Authenticator wrapper](https://github.com/apache/iceberg-rust/blob/a9ad7e2c0104d08535f7cc19cc8d5785c1a67ba6/crates/catalog/rest/src/token.rs#L77-L111) + GCP Token Provider)_: - https://github.com/MaterializeInc/materialize/blob/5066cda9bb06ac726a999c3d9f12f199e9673f75/src/storage-types/src/connections/gcp.rs#L161-L190 ---- ### Proposal for an authenticator trait to upstream into `apache/iceberg-rust` #### `RequestAuthenticator`/`Authenticator` Almost exactly the same as #2088. Most importantly, `mut` access to the entire request _(needed for SigV4)_: https://github.com/apache/iceberg-rust/blob/a9ad7e2c0104d08535f7cc19cc8d5785c1a67ba6/crates/catalog/rest/src/token.rs#L48-L49 #### Helper types and traits: `BearerTokenAuthenticator` + `trait TokenProvider` OAuth2 and `gcp_auth` (and the static token config option) all provide bearer tokens the authenticator can put in a request header. A `BearerTokenAuthenticator` holds a `impl TokenProvider` so it can act as `impl RequestAuthenticator`. Similar to #2088's `OAuth2Authenticator`, but split into two parts. ### Draft diff _to add just these new traits_ without breaking anything: Here's a full diff illustrating what I have in mind. I did my best to preserve the existing auth behavior and config APIs. https://github.com/apache/iceberg-rust/compare/main...MaterializeInc:iceberg-rust:to-upstream/requestauthenticator ---- ### Next steps I'm actively working on [Materialize's support for Iceberg](https://materialize.com/docs/serve-results/sink/iceberg/). I'd like to get our `iceberg-rust` fork closer to upstream, so I'm happy to drive this if it needs a driver. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
