From ed4c0cbf3650ab46bfc2f3a8c863503f28f9a6e9 Mon Sep 17 00:00:00 2001 From: Dmitri Bourlatchkov Date: Wed, 4 Sep 2024 11:46:50 -0400 Subject: [PATCH] Correct the handling of access delegation mode (#211) --- docs/index.html | 6 +- docs/quickstart.md | 2 +- notebooks/SparkPolaris.ipynb | 4 +- .../service/catalog/AccessDelegationMode.java | 74 +++++++++++++++++++ .../catalog/IcebergCatalogAdapter.java | 34 ++++++--- .../catalog/PolarisCatalogHandlerWrapper.java | 4 +- .../catalog/AccessDelegationModeTest.java | 66 +++++++++++++++++ ...PolarisCatalogHandlerWrapperAuthzTest.java | 16 ++-- regtests/setup.sh | 2 +- regtests/t_pyspark/src/iceberg_spark.py | 2 +- spec/index.yaml | 2 +- 11 files changed, 181 insertions(+), 31 deletions(-) create mode 100644 polaris-service/src/main/java/org/apache/polaris/service/catalog/AccessDelegationMode.java create mode 100644 polaris-service/src/test/java/org/apache/polaris/service/catalog/AccessDelegationModeTest.java diff --git a/docs/index.html b/docs/index.html index 67c333ee6..861bce66e 100644 --- a/docs/index.html +++ b/docs/index.html @@ -777,7 +777,7 @@

Creating a Principal a <span class="token parameter variable">--packages</span> org.apache.iceberg:iceberg-spark-runtime-3.5_2.12:1.5.2,org.apache.hadoop:hadoop-aws:3.4.0 <span class="token punctuation">\</span> <span class="token parameter variable">--conf</span> <span class="token assign-left variable">spark.sql.extensions</span><span class="token operator">=</span>org.apache.iceberg.spark.extensions.IcebergSparkSessionExtensions <span class="token punctuation">\</span> <span class="token parameter variable">--conf</span> <span class="token assign-left variable">spark.sql.catalog.quickstart_catalog.warehouse</span><span class="token operator">=</span>quickstart_catalog <span class="token punctuation">\</span> -<span class="token parameter variable">--conf</span> spark.sql.catalog.quickstart_catalog.header.X-Iceberg-Access-Delegation<span class="token operator">=</span>true <span class="token punctuation">\</span> +<span class="token parameter variable">--conf</span> spark.sql.catalog.quickstart_catalog.header.X-Iceberg-Access-Delegation<span class="token operator">=</span>vended-credentials <span class="token punctuation">\</span> <span class="token parameter variable">--conf</span> <span class="token assign-left variable">spark.sql.catalog.quickstart_catalog</span><span class="token operator">=</span>org.apache.iceberg.spark.SparkCatalog <span class="token punctuation">\</span> <span class="token parameter variable">--conf</span> spark.sql.catalog.quickstart_catalog.catalog-impl<span class="token operator">=</span>org.apache.iceberg.rest.RESTCatalog <span class="token punctuation">\</span> <span class="token parameter variable">--conf</span> <span class="token assign-left variable">spark.sql.catalog.quickstart_catalog.uri</span><span class="token operator">=</span>http://localhost:8181/api/catalog <span class="token punctuation">\</span> @@ -835,7 +835,7 @@

Connecting with Spark

--packages org.apache.iceberg:iceberg-spark-runtime-3.5_2.12:1.5.2,org.apache.hadoop:hadoop-aws:3.4.0 \ --conf spark.sql.extensions=org.apache.iceberg.spark.extensions.IcebergSparkSessionExtensions \ --conf spark.sql.catalog.quickstart_catalog.warehouse=quickstart_catalog \ ---conf spark.sql.catalog.quickstart_catalog.header.X-Iceberg-Access-Delegation=true \ +--conf spark.sql.catalog.quickstart_catalog.header.X-Iceberg-Access-Delegation=vended-credentials \ --conf spark.sql.catalog.quickstart_catalog=org.apache.iceberg.spark.SparkCatalog \ --conf spark.sql.catalog.quickstart_catalog.catalog-impl=org.apache.iceberg.rest.RESTCatalog \ --conf spark.sql.catalog.quickstart_catalog.uri=http://localhost:8181/api/catalog \ @@ -3650,7 +3650,7 @@

featureConfiguratio " class="sc-euGpHm sc-exayXG fwfkcU jYGAQp">

Generic base server URL, with all parts configurable

{scheme}://{host}:{port}/{basePath}/v1/{prefix}/views/rename

Request samples

Content type
application/json
{
  • "source": {
    },
  • "destination": {
    }
}

Response samples

Content type
application/json
{
  • "error": {
    }
}