feat: Implement OAuth2 authentication for REST catalog#577
feat: Implement OAuth2 authentication for REST catalog#577lishuxu wants to merge 2 commits intoapache:mainfrom
Conversation
wgtmac
left a comment
wgtmac
left a comment
There was a problem hiding this comment.
This is a comprehensive code review report generated by gemini-cli against PR #577. The review rigorously compares the C++ implementation with the RFC 6749 (OAuth2) spec and the current Iceberg Java behavior.
Overall, the structure and C++ style are excellent, but there are a few parity and robustness issues that need addressing.
| } | ||
| const auto& credential = credential_it->second; | ||
| auto colon_pos = credential.find(':'); | ||
| if (colon_pos == std::string::npos) { |
There was a problem hiding this comment.
OAuth2Util.parseCredential allows credentials without a colon (:). If no colon is found, the entire string is treated as the client_secret and client_id becomes null/empty. This is required for some IdP setups that only provide a secret/bearer token. Please update the parsing logic to fall back to client_secret = credential and client_id = "".
| const std::string& scope, AuthSession& session) { | ||
| std::unordered_map<std::string, std::string> form_data{ | ||
| {std::string(kGrantType), std::string(kClientCredentials)}, | ||
| {std::string(kClientId), client_id}, |
There was a problem hiding this comment.
Following the Java parity fix above (where client_id might be empty), you should only append client_id to the form_data if it is not empty:
if (!client_id.empty()) {
form_data.emplace(std::string(kClientId), client_id);
}| ICEBERG_ASSIGN_OR_RAISE(response.token_type, | ||
| GetJsonValue<std::string>(json, kTokenType)); | ||
| ICEBERG_ASSIGN_OR_RAISE(response.expires_in, | ||
| GetJsonValueOrDefault<int64_t>(json, kExpiresIn, 0)); |
There was a problem hiding this comment.
💡 Future-proofing / JWT Expiration: If expires_in is missing and the token is a JWT, Iceberg Java decodes the JWT payload to extract the exp claim. While defaulting to 0 here is acceptable since auto-refresh is marked as a TODO, consider adding a comment here as a reminder for the future auto-refresh implementation.
2 participants
Add OAuth2 authentication support for the REST catalog, including:
Also includes:
headers properly override defaults
TODO:
RefreshToken and ExchangeToken will be supported later