You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "fivetran-arunsuri (via GitHub)" <gi...@apache.org> on 2025/06/24 18:43:24 UTC
[I] Passing ClientId as parameter while creating principal doesn't work [polaris]
fivetran-arunsuri opened a new issue, #1929:
URL: https://github.com/apache/polaris/issues/1929
### Describe the bug
Hey Team,
I was trying to verify some of Polaris management API's. I found out that even though the documentation says we can pass clientId as param while creating the principal, it doesn't seems to be working fine
### To Reproduce
1. Start the server and bootstrap with root credentials
2. create the token
3. Hit the http://localhost:8181/api/management/v1/principals API for generating the principal with boday as below
{
"name": "principal-1",
"clientId": "arman"
}
it generates the principal as
{
"principal": {
"name": "principal-3",
"clientId": "9cc-blah-blah",
"properties": {},
"createTimestamp": 1750756252079,
"lastUpdateTimestamp": 1750756252079,
"entityVersion": 1
},
"credentials": {
"clientId": "9cc-bla-bha",
"clientSecret": "blah-blah"
}
}
### Actual Behavior
it generates the principal as
{
"principal": {
"name": "principal-3",
"clientId": "9cc-blah-blah",
"properties": {},
"createTimestamp": 1750756252079,
"lastUpdateTimestamp": 1750756252079,
"entityVersion": 1
},
"credentials": {
"clientId": "9cc-bla-bha",
"clientSecret": "blah-blah"
}
}
### Expected Behavior
It should ideally preserve the clientId we are passing from the body and only generate the clientSecret
### Additional context
Also, Why are we not allowing users to set their own clientId and clientSecret while creating the principal?
I am looking for a solution like register principal with older credentials preserved? Can we do that?
### System information
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "fivetran-arunsuri (via GitHub)" <gi...@apache.org>.
fivetran-arunsuri commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3044232715
@fivetran-raulpersa and @fivetran-kostaszoumpatianos for viz
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "fivetran-arunsuri (via GitHub)" <gi...@apache.org>.
fivetran-arunsuri commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3044226999
Thanks for the response, @dimas-b.
Using the Admin Tool for principal manipulation would introduce additional complexity to our migration workflow. Our primary requirement is to retain the same client credentials (clientId and clientSecret) across both versions of Polaris (0.9 and 1.0), ensuring a smooth migration path and the ability to roll back seamlessly in case of unforeseen issues.
Introducing support for optional clientId and clientSecret parameters in the createPrincipal API request body appears to be the most straightforward and practical solution for our use case. It would eliminate the need for manual credential injection or tool-based workarounds and provide a consistent way to maintain credential continuity during version transitions.
Additionally, we believe this capability could be beneficial to others who are migrating between versions of Polaris and want to preserve existing user credentials without disruption. It would be great to get your thoughts on this direction.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3036379789
@fivetran-arunsuri : Thanks for the detailed explanation. Your use case makes sense to me đź‘Ť
However, I'd think this kind of principal manipulation probably belongs to the [Admin Tool](https://github.com/apache/polaris/tree/main/runtime/admin).
The Admin Tool could offer a new command with CLI arguments or file inputs (JSON?).
Would that fit your workflows?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3045487786
@fivetran-arunsuri : I do not mean to block your suggestion, although I do think there are some security concerns with allowing arbitrary client IDs and sending passwords on the wire. In any case, it's a major API change and the current process is to initiate `dev` list discussions in these cases. Would you mind starting a thread on the `dev` email list for this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "eric-maynard (via GitHub)" <gi...@apache.org>.
eric-maynard commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3001728593
The spec notes clientId is output-only here:
```yaml
clientId:
type: string
description: The output-only OAuth clientId associated with this principal if applicable
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "eric-maynard (via GitHub)" <gi...@apache.org>.
eric-maynard commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3028621374
(aside: filed #1992 to improve the example linked above)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3028612819
This feels like a discussion of how the Authorization side of Polaris works (handling Principals managed by Polaris).
The Client ID here basically refers to the Client Credentials flow (OAuth2).
RFC [6749](https://www.rfc-editor.org/rfc/rfc6749#page-15) states that "The authorization server issues the registered client a client identifier". So, I'd say Polaris is within its role as an Authorization server in this case.
That said, @fivetran-arunsuri : could you give us a bit more details why you'd like to control client IDs?
Note that it is currently possible to set custom client IDs for the "root" user during boostrapping (see the `bootstrap` command from the admin tool).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "fivetran-arunsuri (via GitHub)" <gi...@apache.org>.
fivetran-arunsuri commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3021053656
```
Also regarding my second question, I would like to know the feasibility of the following
Why are we not allowing users to set their own clientId and clientSecret while creating the principal?
I am looking for a solution like register principal with older credentials preserved? Can we do that like we do for the root credentials?
```
@eric-maynard following up on my previous query?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3052331018
Honestly, I think that having more functionality that gears towards
what IdPs are is adding quite some burden (see Dmitri's security
concerns) to the Polaris project.
IMHO the management of principals (aka: client-IDs/secrets) in Polaris
is rather something to get Polaris up and running quickly. For
production purposes I'd always recommend relying on a "proper IdP".
Now, in your migration one-off use case you could consider migrating
the "raw tables". Because of the different ways the persistence
implementations generate IDs, I'd personally not do that though, but
it's an option with a lot of fine print wrt testing of course.
On Mon, Jul 7, 2025 at 4:47 PM Dmitri Bourlatchkov
***@***.***> wrote:
>
> dimas-b left a comment (apache/polaris#1929)
>
> @fivetran-arunsuri : I do not mean to block your suggestion, although I do think there are some security concerns with allowing arbitrary client IDs and sending passwords on the wire. In any case, it's a major API change and the current process is to initiate dev list discussions in these cases. Would you mind starting a thread on the dev email list for this?
>
> —
> Reply to this email directly, view it on GitHub, or unsubscribe.
> You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "fivetran-arunsuri (via GitHub)" <gi...@apache.org>.
fivetran-arunsuri commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3002360095
@eric-maynard The swagger Request body for the given API looks like this, could be auto generated but we need to correct that right?
<img width="836" alt="Image" src="https://github.com/user-attachments/assets/2efd9d03-eee2-43af-97c4-0459e0ceff8d" />
Also regarding my second question, I would like to know the feasibility of the following
Why are we not allowing users to set their own clientId and clientSecret while creating the principal?
I am looking for a solution like register principal with older credentials preserved? Can we do that like we do for the root credentials?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "fivetran-arunsuri (via GitHub)" <gi...@apache.org>.
fivetran-arunsuri commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3036155876
@dimas-b @eric-maynard Thanks for the response.
We’re in the process of migrating our self-hosted Polaris service from version 0.9 (EclipseLink) to 1.0 (JDBC-based metastore) in order to take advantage of the latest features and improvements in Polaris.
As part of this migration, we already have existing users registered with specific client credentials. Rotating these credentials is not an option, as it would break downstream queries and integrations for our customers.
We were hoping to register principals using existing clientId and clientSecret values, but currently the createPrincipal API does not support this—it always generates random credentials and stores them after salting and hashing.
We’re requesting either:
- a new API that allows registering a principal with user-defined credentials, or
- support for this functionality in an existing principal registration API.
This capability would significantly simplify our migration process, ensuring compatibility with existing credentials across both Polaris versions. Manual copying of principals isn’t a viable alternative, as it wouldn’t preserve the hashed credentials consistently across versions.
I will also explore the option of passing these credentials manually—similar to how we handle it during bootstrap—but instead of using command-line input, we’d pass them in the request body.
Would love to hear your thoughts on this approach before making any changes or opening a PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Passing ClientId as parameter while creating principal doesn't work [polaris]
Posted by "eric-maynard (via GitHub)" <gi...@apache.org>.
eric-maynard commented on issue #1929:
URL: https://github.com/apache/polaris/issues/1929#issuecomment-3028570798
Hey @fivetran-arunsuri, sorry I missed your previous comment.
From the service POV, I'm not sure whether or not creating a principal with specific _secret_ is something we want to support. At best, it's fair to say we don't have that feature today. Instead, you could achieve this either by creating the principal directly in the metastore or directly with an external IdP.
As for the example in the docs, I agree that's misleading. I think that's auto-generated by Swagger though, so I'm not sure of the easiest way to fix that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org