You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "flyrain (via GitHub)" <gi...@apache.org> on 2024/02/22 23:22:08 UTC
[I] Support ID Tokens in Rest Catalog [iceberg-python]
flyrain opened a new issue, #464:
URL: https://github.com/apache/iceberg-python/issues/464
### Feature Request / Improvement
[ID Tokens](https://auth0.com/docs/secure/tokens/id-tokens) are commonly used in a scenario that a server combines authentication and authorization in a single API call. PyIceberg only supports [access tokens](https://github.com/apache/iceberg-python/blob/44948cd9bab78b509b6befc960b5f248b37f53fe/pyiceberg/catalog/rest.py#L455-L455) now. Can we support ID token as well? cc @danielcweeks @Fokko @syun64 @RussellSpitzer
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Support ID Tokens in Rest Catalog [iceberg-python]
Posted by "syun64 (via GitHub)" <gi...@apache.org>.
syun64 commented on issue #464:
URL: https://github.com/apache/iceberg-python/issues/464#issuecomment-1979940847
Awesome. Thanks for raising this issue in the first place and walking the community through this discussion!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Support ID Tokens in Rest Catalog [iceberg-python]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on issue #464:
URL: https://github.com/apache/iceberg-python/issues/464#issuecomment-1979866702
Yeah, it is normally an anti-pattern to use id-token for resource servers. For example, the id token will carry all audiences that the client has, which could be misused, e.g., a client has audiences `[rest-catalog, resource service B]`, while access token can limit the audience by specifying it in the request, so that an access token will only have the audience `rest-catalog`. However, the risk of id token may be well controlled depending on the special use cases in certain orgs.
Given that is an anti-pattern corner case, we can close this now. We may figure it out with different solutions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Support ID Tokens in Rest Catalog [iceberg-python]
Posted by "syun64 (via GitHub)" <gi...@apache.org>.
syun64 commented on issue #464:
URL: https://github.com/apache/iceberg-python/issues/464#issuecomment-1979774474
@flyrain do you have any thoughts on this? Does this issue require more discussion, or could we close this with the understanding that ID tokens should not be used against a resource server?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Support ID Tokens in Rest Catalog [iceberg-python]
Posted by "syun64 (via GitHub)" <gi...@apache.org>.
syun64 commented on issue #464:
URL: https://github.com/apache/iceberg-python/issues/464#issuecomment-1960585674
> 1. Client sends id tokens and resource to the authorization server to get access token.
>
> 2. Client sends access tokens to access a resource.
I think you described it very well here. It looks like there's a front-end component involved in your client application where the user authenticates and authorizes themselves, and the client backend sends a request to the PyIceberg to fetch some results. From my understanding that's exactly what the [OIDC Protocol](https://openid.net/developers/how-connect-works/) is, and it's intended to prevent security vulnerabilities you might expose by sending an ID_TOKEN to a resource server.
> However, in reality, it is also common that a resource server(e.g., rest catalog) want to handle authorization and authentication in a single call, so that id token will be used for that case.
Yeah, this is a pretty interesting point. If the Rest Catalog can be elevated to also be an Authentication server, then maybe there isn't issue in doing this. In my opinion, it feels very unusual for a Resource Server to also be an Authenticator. An Iceberg Rest Catalog has very little to do with User Identity and is strictly a backend API. Why would we want to group in the work of Authenticating into it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Support ID Tokens in Rest Catalog [iceberg-python]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on issue #464:
URL: https://github.com/apache/iceberg-python/issues/464#issuecomment-1960559522
That's definitely true. That's actually what id token and access token are designed for. In that case, the authorization and authentication are separated calls.
1. Client sends id tokens and resource to the authorization server to get access token.
2. Client sends access tokens to access a resource.
However, in reality, it is also common that a resource server(e.g., rest catalog) want to handle authorization and authentication in a single call, so that id token will be used for that case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Support ID Tokens in Rest Catalog [iceberg-python]
Posted by "syun64 (via GitHub)" <gi...@apache.org>.
syun64 closed issue #464: Support ID Tokens in Rest Catalog
URL: https://github.com/apache/iceberg-python/issues/464
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Support ID Tokens in Rest Catalog [iceberg-python]
Posted by "syun64 (via GitHub)" <gi...@apache.org>.
syun64 commented on issue #464:
URL: https://github.com/apache/iceberg-python/issues/464#issuecomment-1960526232
My understanding is that when a backend client is talking to an API server, we should only support Client Credentials Flow or the direct use of access tokens. We are validating that PyIceberg Client application has the authorization to use the resource Server (Rest Catalog), instead of identifying who the user is (ID of the person behind the application). So it feels odd to me to introduce the usage of ID_TOKEN as a means of authorization.
That's my opinion, but I'm curious to hear what others think on this topic!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org