You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "szymonorz (via GitHub)" <gi...@apache.org> on 2025/06/17 17:06:36 UTC
[I] OAuth2: `OAuth2Manager#newSessionFromCredential` shouldn't pass `Authorization: Bearer xxx` from `parent` [iceberg]
szymonorz opened a new issue, #13337:
URL: https://github.com/apache/iceberg/issues/13337
### Apache Iceberg version
1.9.1 (latest release)
### Query engine
Trino
### Please describe the bug 🐞
Hi,
while trying to integrate Trino into the analytic stack at the company I work at I noticed there seems to be a faulty implementation of the client credentials OAuth2 flow. We use CAS for OpenID Connect https://apereo.github.io/cas/7.2.x/index.html
Per [RFC 6749 Section 2.3](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3)
```
The client MUST NOT use more than one authentication method in each request.
```
However when debugging Trino I noticed that the Iceberg library calls `OAuth2Manager#newSessionFromCredential` with `parent` session headers which has `Authorization` set with `Bearer` token. CAS treats such request as `Bad request` making Trino unusable with Iceberg with OAuth2 enabled. Maybe other OIDC providers don't follow this spec.
Trino doesn't do anything extra than calling `RESTSessionCatalog#listNamespaces(Session.SessionContext, Namespace)` for example.
Tested on Trino 474, 475 and 476.
I'm not fluent with the Iceberg codebase but maybe adding code that would remove the `Authorization: Bearer xxx` header in `OAuth2Manager#newSessionFromCredential` method would work.
### Willingness to contribute
- [ ] I can contribute a fix for this bug independently
- [x] I would be willing to contribute a fix for this bug with guidance from the Iceberg community
- [ ] I cannot contribute a fix for this bug at this time
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] OAuth2: `OAuth2Manager#newSessionFromCredential` shouldn't pass `Authorization: Bearer xxx` from `parent` [iceberg]
Posted by "alexjbuck (via GitHub)" <gi...@apache.org>.
alexjbuck commented on issue #13337:
URL: https://github.com/apache/iceberg/issues/13337#issuecomment-3462911147
For those who may find this... I've had some luck in my docker compose dev environment by adding a proxy to strip the `Authorization` header from requests to `<oauth2-provider>/oauth2/token`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] OAuth2: `OAuth2Manager#newSessionFromCredential` shouldn't pass `Authorization: Bearer xxx` from `parent` [iceberg]
Posted by "bharos (via GitHub)" <gi...@apache.org>.
bharos commented on issue #13337:
URL: https://github.com/apache/iceberg/issues/13337#issuecomment-4277220315
I came across this while reviewing the OAuth2 auth code. The issue is that [fromCredential() passes parent.headers() ](https://github.com/apache/iceberg/blob/49839545d0027f17970868c5044f8005abce1267/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java#L661)(which contains the parent's Bearer token) to fetchToken, while all other fetchToken call sites correctly pass Map.of(). I'll open a PR shortly
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] OAuth2: `OAuth2Manager#newSessionFromCredential` shouldn't pass `Authorization: Bearer xxx` from `parent` [iceberg]
Posted by "alexjbuck (via GitHub)" <gi...@apache.org>.
alexjbuck commented on issue #13337:
URL: https://github.com/apache/iceberg/issues/13337#issuecomment-3462791948
This issue is still present in Iceberg 1.10, also discovered while using Trino 477 as the query engine and AWS Cognito as the OAuth2 server.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] OAuth2: `OAuth2Manager#newSessionFromCredential` shouldn't pass `Authorization: Bearer xxx` from `parent` [iceberg]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #13337:
URL: https://github.com/apache/iceberg/issues/13337#issuecomment-6243711079
This issue has been automatically marked as stale because it has been open for 180 days with no activity. It will be closed in next 14 days if no further activity occurs. To permanently prevent this issue from being considered stale, add the label 'not-stale', but commenting on the issue is preferred when possible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org