[I] Azure credential vending can issue immediately invalid user-delegation SAS credentials under clock skew [polaris]

["fivetran-arunsuri (via GitHub)" <gi...@apache.org>]

fivetran-arunsuri opened a new issue, #5484:
URL: https://github.com/apache/polaris/issues/5484

   ### Describe the bug
   
   Description
   
   Polaris’s Azure credential-vending flow requests an Azure user-delegation key using Polaris’s current wall-clock time as the key start time. The returned key is then used to sign the SAS credentials issued to Blob Storage and ADLS clients.
   
   If Azure Storage or the client consuming the vended SAS has a clock that is slightly behind Polaris’s clock, the delegation key may not yet be valid from Azure’s perspective. As a result, the newly vended SAS can fail immediately instead of being usable for its configured lifetime.
   
   Observed exception:
   
   Signature not valid in the specified key time frame
   
   This affects the Azure Blob and ADLS credential-vending paths. The problem is intermittent because it depends on clock differences between Polaris, Azure Storage, and the consuming storage client.
   
   Expected behavior
   
   Freshly vended Azure SAS credentials should be usable immediately despite normal clock skew between Polaris, Azure Storage, and storage clients.
   
   Proposed fix
   
   Backdate the  getUserDelegationKey(...)  start time by a clock-skew buffer before requesting the key. Use the adjusted start time when calculating the maximum delegation-key expiry, while preserving the configured SAS expiry where it remains valid.
   
   The delegation key and SAS expiry must remain within Azure Storage’s seven-day validity limit. A one-minute margin should be retained at the maximum expiry boundary.
   
   Microsoft documentation
   
   • Grant limited access to data with shared access signatures (SAS) states that a SAS start time set to the current time can cause intermittent failures because of clock skew. It recommends using a start time at least 15 minutes in the past, or omitting the SAS start time.
   • Create a user delegation SAS for a blob with Java shows the Java user-delegation-key request with a five-minute backdate:
   blobServiceClient.getUserDelegationKey(
       OffsetDateTime.now().minusMinutes(5),
       OffsetDateTime.now().plusDays(1));
   • Get User Delegation Key REST API requires both the delegation-key start and expiry timestamps to be within seven days of the current date.
   
   ### To Reproduce
   
   _No response_
   
   ### Actual Behavior
   
   _No response_
   
   ### Expected Behavior
   
   _No response_
   
   ### Additional context
   
   _No response_
   
   ### System information
   
   _No response_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Azure credential vending can issue immediately invalid user-delegation SAS credentials under clock skew [polaris]

["dimas-b (via GitHub)" <gi...@apache.org>]

dimas-b closed issue #5484: Azure credential vending can issue immediately invalid user-delegation SAS credentials under clock skew
URL: https://github.com/apache/polaris/issues/5484


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org