Skip to content

[#9564] fix(authn): Fix Flink connector oauth2 mode #9618

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jerqi merged 3 commits into from
Jan 8, 2026
+20 −9
Merged

[#9564] fix(authn): Fix Flink connector oauth2 mode #9618

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
94386c4
[#9564] fix(authn): Fix Flink connector oauth2 mode
jerqi Jan 5, 2026
1c0ad9b
address comments
jerqi Jan 5, 2026
31ac83c
Use one log
jerqi Jan 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/flink-connector/flink-authentication-with-gravitino.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ table.catalog-store.gravitino.gravitino.metalake: my_metalake
table.catalog-store.gravitino.gravitino.client.auth.type: oauth2
table.catalog-store.gravitino.gravitino.client.oauth2.serverUri: https://oauth-server.example.com
table.catalog-store.gravitino.gravitino.client.oauth2.tokenPath: /oauth/token
table.catalog-store.gravitino.gravitino.client.oauth2.credential: your-client-credentials
table.catalog-store.gravitino.gravitino.client.oauth2.credential: client-id:client-secret
table.catalog-store.gravitino.gravitino.client.oauth2.scope: your-scope
```

Expand Down
26 changes: 18 additions & 8 deletions ...k/src/main/java/org/apache/gravitino/flink/connector/catalog/GravitinoCatalogManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,7 @@
import java.util.Arrays;
import java.util.Map;
import java.util.Set;
import org.apache.commons.lang3.StringUtils;
import org.apache.gravitino.Catalog;
import org.apache.gravitino.auth.AuthenticatorType;
import org.apache.gravitino.client.DefaultOAuth2TokenProvider;
import org.apache.gravitino.client.GravitinoAdminClient;
import org.apache.gravitino.client.GravitinoMetalake;
Expand Down Expand Up @@ -66,7 +64,7 @@ private GravitinoCatalogManager(

// Only OAuth is explicitly configured; otherwise follow Flink security (Kerberos if enabled,
// simple auth otherwise).
if (AuthenticatorType.OAUTH.name().equalsIgnoreCase(authType)) {
if (GravitinoCatalogStoreFactoryOptions.OAUTH2.equalsIgnoreCase(authType)) {
Copy link
Contributor

@FANNG1 FANNG1 Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any reason for using a new constant?

Copy link
Contributor Author

@jerqi jerqi Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OAUTH name is oauth. We need OAUTH2 here.
Spark use the constants in the catalog-common.
So I defined a new constant here.
I will refactor related code in the future. I can create an issue for this.

this.gravitinoClient = buildOAuthClient(gravitinoUri, gravitinoClientConfig);
} else {
if (authType != null) {
Expand All @@ -76,6 +74,11 @@ private GravitinoCatalogManager(
authType, GravitinoCatalogStoreFactoryOptions.AUTH_TYPE));
}

LOG.info(
"Flink security enabled: {}, Current user: {}",
UserGroupInformation.isSecurityEnabled(),
getUgi().getUserName());

if (UserGroupInformation.isSecurityEnabled()) {
if (getUgi().getAuthenticationMethod()
!= UserGroupInformation.AuthenticationMethod.KERBEROS) {
Expand Down Expand Up @@ -247,14 +250,21 @@ private static GravitinoAdminClient buildOAuthClient(
String credential = config.get(GravitinoCatalogStoreFactoryOptions.OAUTH2_CREDENTIAL);
String path = config.get(GravitinoCatalogStoreFactoryOptions.OAUTH2_TOKEN_PATH);
String scope = config.get(GravitinoCatalogStoreFactoryOptions.OAUTH2_SCOPE);
Preconditions.checkArgument(
StringUtils.isNoneBlank(serverUri, credential, path, scope),
String.format(
"OAuth2 authentication requires: %s, %s, %s, and %s",

// Remove OAuth-specific config entries from the client config map. These keys are only
// used to construct the OAuth2 token provider and are not valid GravitinoAdminClient
// client configuration options; passing them to withClientConfig() could cause validation
// errors or other unexpected behavior.
Set<String> oauthConfigKeys =
Sets.newHashSet(
GravitinoCatalogStoreFactoryOptions.AUTH_TYPE,
GravitinoCatalogStoreFactoryOptions.OAUTH2_SERVER_URI,
GravitinoCatalogStoreFactoryOptions.OAUTH2_CREDENTIAL,
GravitinoCatalogStoreFactoryOptions.OAUTH2_TOKEN_PATH,
GravitinoCatalogStoreFactoryOptions.OAUTH2_SCOPE));
GravitinoCatalogStoreFactoryOptions.OAUTH2_SCOPE);
for (String key : oauthConfigKeys) {
config.remove(key);
}

DefaultOAuth2TokenProvider provider =
DefaultOAuth2TokenProvider.builder()
Expand Down
1 change: 1 addition & 0 deletions .../java/org/apache/gravitino/flink/connector/store/GravitinoCatalogStoreFactoryOptions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ private GravitinoCatalogStoreFactoryOptions() {}
.withDescription("The config of Gravitino client");

public static final String AUTH_TYPE = "gravitino.client.auth.type";
public static final String OAUTH2 = "oauth2";

// OAuth2 config keys
public static final String OAUTH2_SERVER_URI = "gravitino.client.oauth2.serverUri";
Expand Down