zhangxinyao88 opened a new issue, #18825: URL: https://github.com/apache/iceberg/issues/18825
The REST spec allows multiple storage credentials with different prefixes, but `VendedCredentialsProvider.refreshCredential()` and `OAuth2RefreshCredentialsHandler.refreshAccessToken()` require exactly one credential of their storage type. A response with two S3 credentials or two GCS credentials fails with `only one S3 credential should exist` or `only one GCS credential should exist`. This limitation is present at `778d103c0fa802be5e85e4cb2e4e4b4bcd8ac891`, the base of #17912. The existing `multipleS3Credentials` and `multipleGcsCredentials` tests assert these failures. I also reproduced the AWS failure through `AwsClientProperties.credentialsProvider()` with a mock endpoint returning two prefix-scoped credentials and initial credentials inside the refresh window. Refresh should preserve the storage client's prefix and select the applicable credential, without using credentials for an unrelated path. The FileIO-level refresh already retrieves a list; the limitation is in the individual client credential providers. Found while reviewing #17912. That PR preserves existing provider selection while fixing endpoint resolution; this issue tracks the existing multi-prefix refresh limitation separately. It is distinct from #18817, #18818, and #18819. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
