-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Auth Manager API part 6: API enablement #12197
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, I just wonder if S3FileIO
is not impacted (around the credentials).
* href="https://docs.aws.amazon.com/general/latest/gr/signing-aws-api-requests.html">Signing AWS | ||
* API requests</a> for details about the protocol. | ||
*/ | ||
public class RESTSigV4Signer implements HttpRequestInterceptor { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should follow a minor version deprecation?
https://iceberg.apache.org/contribute/?h=contri#minor-version-deprecations-discretionary
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @ajantha-bhat I think the deprecation cycle does not apply here because this component is not meant to be instantiated by users directly. It was only instantiated by reflection when SigV4 was enabled:
iceberg/core/src/main/java/org/apache/iceberg/rest/HTTPClient.java
Lines 558 to 560 in 0bc6dfa
if (PropertyUtil.propertyAsBoolean(properties, SIGV4_ENABLED, false)) { | |
interceptor = loadInterceptorDynamically(SIGV4_REQUEST_INTERCEPTOR_IMPL, properties); | |
} |
But I'm happy to keep this class around if others think that's better.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ACK.
6th and last PR for the Auth Manager API. Previous ones:
Once this PR is merged, the AuthManager API becomes effective.
Summary of changes:
OAuth2Manager
, mostly to properly handle empty auth sessions, as decided in Auth Manager API part 4: RESTClient, HTTPClient #11992;HttpInterceptor
code inHTTPClient
and related tests;RESTSessionCatalog
;VendedCredentialsProvider
andOAuth2RefreshCredentialsHandler
OAuth2RefreshCredentialsHandler
now caches itsHTTPClient
andAuthSession
, instead of creating a new client and session for every refresh – pretty much likeVendedCredentialsProvider
already does.