You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "lxy714433989 (via GitHub)" <gi...@apache.org> on 2026/04/27 16:02:35 UTC
[PR] feat(java/flight-sql): add OAuth2 support [arrow-adbc]
lxy714433989 opened a new pull request, #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272
## Summary
This PR adds OAuth2 authentication support to the Java Flight SQL ADBC driver.
It introduces a configurable OAuth2 mechanism that allows clients to acquire and attach access tokens when establishing Flight SQL connections.
## Motivation
The current Java Flight SQL driver supports basic authentication and custom authorization headers, but lacks a standardized way to configure OAuth2-based authentication.
Many production deployments rely on OAuth2 (e.g., via identity providers such as Keycloak or cloud IAM systems). This change enables native OAuth2 support at the driver level, improving usability and reducing the need for custom integration logic.
## Changes
- Add OAuth2-related connection options
- token endpoint
- client credentials
- grant type (initial support focuses on client credentials flow)
- Introduce `FlightSqlOAuthTokenProvider`
- Responsible for acquiring and refreshing access tokens
- Encapsulates OAuth2 logic from connection layer
- Integrate OAuth authentication into `FlightSqlConnection`
- Automatically attaches `Authorization: Bearer <token>` header
- Add validation for conflicting authentication configurations
- Prevent simultaneous usage of:
- username/password
- custom Authorization headers
- OAuth2 configuration
- Add unit tests for OAuth2 authentication behavior
## Scope
This PR only introduces OAuth2 support on the **Java Flight SQL driver side**.
- No changes to Flight SQL protocol
- No server-side changes required
- Backward compatible with existing authentication mechanisms
## Testing
- Added unit tests in `OAuthTest.java`
- Verified:
- token acquisition and injection
- conflict validation logic
- existing authentication paths remain unaffected
## Compatibility
This change is fully backward compatible:
- Existing configurations (basic auth / headers) continue to work
- OAuth2 is opt-in via new connection parameters
## Future Work
- Support additional OAuth2 flows (e.g., authorization code)
- Token caching and refresh improvements
- Integration with external credential providers
## Notes for Reviewers
- The implementation is intentionally scoped to client-side changes only
- Feedback on API design (connection options and token provider abstraction) is especially welcome
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(java/driver/flight-sql): add OAuth2 support [arrow-adbc]
Posted by "xborder (via GitHub)" <gi...@apache.org>.
xborder commented on code in PR #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272#discussion_r3168399448
##########
java/driver/flight-sql/src/main/java/org/apache/arrow/adbc/driver/flightsql/FlightSqlOAuthTokenProvider.java:
##########
Review Comment:
I think it is ok to bump arrow-java version. 19.0.0 already got released. That way, refactoring the implementation to make it closer to arrow-java would be simpler
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(java/driver/flight-sql): add OAuth2 support [arrow-adbc]
Posted by "lxy714433989 (via GitHub)" <gi...@apache.org>.
lxy714433989 commented on code in PR #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272#discussion_r3168313802
##########
java/driver/flight-sql/src/main/java/org/apache/arrow/adbc/driver/flightsql/FlightSqlOAuthTokenProvider.java:
##########
Review Comment:
That makes sense. Since ADBC currently depends on Arrow Java 18.3.0 and the Arrow Java OAuth classes are not available in that version yet, directly reusing the JDBC implementation would require bumping the Arrow Java dependency.
Would you prefer that I refactor the ADBC implementation in this PR to more closely mirror the Arrow Java JDBC OAuth structure, or should we wait until ADBC updates to an Arrow Java version that includes those OAuth classes and then reuse the implementation ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(java/driver/flight-sql): add OAuth2 support [arrow-adbc]
Posted by "lxy714433989 (via GitHub)" <gi...@apache.org>.
lxy714433989 commented on code in PR #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272#discussion_r3167068970
##########
java/driver/flight-sql/src/main/java/org/apache/arrow/adbc/driver/flightsql/FlightSqlOAuthTokenProvider.java:
##########
Review Comment:
Thanks for the suggestions.
I’d prefer to keep this in the pure Java Flight SQL driver instead of relying on the Go driver through JNI, since JNI would introduce native dependencies and additional deployment complexity for Java users.
For the OAuth2 implementation, I agree that we should use an existing library rather than hand-roll the protocol details. I noticed that Arrow Java already uses Nimbus OAuth2 SDK, so I think Nimbus would be a good fit for Java ADBC as well. I’ll update the PR accordingly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [ADBC][Java] Add OAuth2 authentication support to Flight SQL driver [arrow-adbc]
Posted by "lxy714433989 (via GitHub)" <gi...@apache.org>.
lxy714433989 commented on PR #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272#issuecomment-4332131982
Linked issue: #4277
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(java/driver/flight-sql): add OAuth2 support [arrow-adbc]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on code in PR #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272#discussion_r3166796787
##########
java/driver/flight-sql/src/main/java/org/apache/arrow/adbc/driver/flightsql/FlightSqlOAuthTokenProvider.java:
##########
Review Comment:
Is there a standard library/common third party library we can leverage for OAuth details?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(java/driver/flight-sql): add OAuth2 support [arrow-adbc]
Posted by "xborder (via GitHub)" <gi...@apache.org>.
xborder commented on code in PR #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272#discussion_r3168108949
##########
java/driver/flight-sql/src/main/java/org/apache/arrow/adbc/driver/flightsql/FlightSqlOAuthTokenProvider.java:
##########
Review Comment:
arrow-java implementation was based on the GO ADBC implementation and slightly changed to use Nimbus OAuth2 SDK. I think we could try to approximate ADBC and JDBC implementations, it might be possible to use arrow-java implementation since it seems ADBC has arrow-java as a dependency
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(java/driver/flight-sql): add OAuth2 support [arrow-adbc]
Posted by "xborder (via GitHub)" <gi...@apache.org>.
xborder commented on code in PR #4272:
URL: https://github.com/apache/arrow-adbc/pull/4272#discussion_r3168108949
##########
java/driver/flight-sql/src/main/java/org/apache/arrow/adbc/driver/flightsql/FlightSqlOAuthTokenProvider.java:
##########
Review Comment:
arrow-java implementation was based on the go implementation and slightly changed to use Nimbus OAuth2 SDK. I think we could try to approximate ADBC and JDBC implementations, it might be possible to use arrow-java implementation since it seems ADBC has arrow-java as a dependency
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(java/driver/flight-sql): add OAuth2 support [arrow-adbc]
Posted by "lxy714433989 (via GitHub)" <gi...@apache.org>.
lxy714433989 closed pull request #4272: feat(java/driver/flight-sql): add OAuth2 support
URL: https://github.com/apache/arrow-adbc/pull/4272
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org