Skip to content

[feature](fe) Support OIDC session credentials for Iceberg REST catalog#63068

Open
CalvinKirs wants to merge 1 commit intoapache:masterfrom
CalvinKirs:feature/rest-catalog-oidc-passthrough-clean
Open

[feature](fe) Support OIDC session credentials for Iceberg REST catalog#63068
CalvinKirs wants to merge 1 commit intoapache:masterfrom
CalvinKirs:feature/rest-catalog-oidc-passthrough-clean

Conversation

@CalvinKirs
Copy link
Copy Markdown
Member

Issue Number: None

Related PR: None

Problem Summary: Allow Iceberg REST catalog to use the authenticated user credential when iceberg.rest.session=user is configured, and avoid sharing Iceberg table/schema/snapshot cache for per-user REST session loads.

Support Iceberg REST catalog user session authentication with OAuth/OIDC delegated credentials.

  • Test: FE UT
    • ./run-fe-ut.sh --run org.apache.doris.datasource.iceberg.IcebergSessionCatalogAdapterTest
    • ./run-fe-ut.sh --run org.apache.doris.datasource.property.metastore.IcebergRestPropertiesTest
    • ./run-fe-ut.sh --run org.apache.doris.mysql.authenticate.AuthenticatorManagerTest
  • Behavior changed: Yes, Iceberg REST catalog can use authenticated user delegated credentials when iceberg.rest.session=user is enabled.
  • Does this need documentation: No

What problem does this PR solve?

Issue Number: close #xxx

Related PR: #xxx

Problem Summary:

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason
  • Behavior changed:

    • No.
    • Yes.
  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@hello-stephen
Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@CalvinKirs CalvinKirs force-pushed the feature/rest-catalog-oidc-passthrough-clean branch 3 times, most recently from 7f15a24 to 99cdca5 Compare May 8, 2026 07:45
### What problem does this PR solve?

Issue Number: None

Related PR: None

Problem Summary: Allow Iceberg REST catalog to use the authenticated user credential when iceberg.rest.session=user is configured, keep delegated credential expiration sourced only from authentication plugin results, and allowlist the test-only fake JWT fixture used by DelegatedCredentialTest.

### Release note

Support Iceberg REST catalog user session authentication with OAuth/OIDC delegated credentials.

### Check List (For Author)

- Test: Unit Test
    - mvn -pl fe-core -am -Dtest=org.apache.doris.datasource.DelegatedCredentialTest,org.apache.doris.mysql.authenticate.AuthenticatorManagerTest -Dcheckstyle.skip=true -DfailIfNoTests=false -Dfe_ut_parallel=0 -Dmaven.build.cache.enabled=false test
    - git diff --cached --check
- Behavior changed: Yes, Iceberg REST catalog can use authenticated user delegated credentials when iceberg.rest.session=user is enabled; delegated credentials do not infer expiration from JWT payload when plugins do not return one.
- Does this need documentation: No
@CalvinKirs CalvinKirs force-pushed the feature/rest-catalog-oidc-passthrough-clean branch from 99cdca5 to d1bbe5b Compare May 8, 2026 08:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants