You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "sachinnn99 (via GitHub)" <gi...@apache.org> on 2026/04/19 05:40:23 UTC
[PR] Core: Pass optionalOAuthParams during non-exchange token refresh [iceberg]
sachinnn99 opened a new pull request, #16046:
URL: https://github.com/apache/iceberg/pull/16046
## Summary
- When `token-exchange-enabled=false`, both `refreshToken()` and `refreshExpiredToken()` passed `ImmutableMap.of()` to `fetchToken()` instead of the stored `optionalOAuthParams` (audience, resource). This caused refreshed tokens to silently lose audience/resource scoping, leading to 401/403 errors or overly broad permissions.
- Fixed by passing `optionalOAuthParams` in both non-exchange code paths (lines 193 and 566 of `OAuth2Util.java`).
- Added tests for both the expired-token and current-token refresh paths verifying that audience and resource are included in the token request form data.
Closes #16022
## Test plan
- [x] `./gradlew :iceberg-core:test --tests TestOAuth2Util` passes
- [ ] CI passes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] Core: Pass optionalOAuthParams during non-exchange token refresh [iceberg]
Posted by "singhpk234 (via GitHub)" <gi...@apache.org>.
singhpk234 commented on PR #16046:
URL: https://github.com/apache/iceberg/pull/16046#issuecomment-4276238095
i believe there is already a pr from the folk who reported this bug
https://github.com/apache/iceberg/pull/16023
please coordinate with them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] Core: Pass optionalOAuthParams during non-exchange token refresh [iceberg]
Posted by "sachinnn99 (via GitHub)" <gi...@apache.org>.
sachinnn99 commented on PR #16046:
URL: https://github.com/apache/iceberg/pull/16046#issuecomment-4277890447
Closing in favor of #16023 — the original reporter's fix covers the same issue. Happy to help review there if needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] Core: Pass optionalOAuthParams during non-exchange token refresh [iceberg]
Posted by "sachinnn99 (via GitHub)" <gi...@apache.org>.
sachinnn99 closed pull request #16046: Core: Pass optionalOAuthParams during non-exchange token refresh
URL: https://github.com/apache/iceberg/pull/16046
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org