Skip to content

Commit 2ea2fcb

Browse files
authored
feat(go/adbc/driver/flightsql): Add OAuth Support to Flight Client (apache#2651)
## Description This pull request introduces OAuth support to the Flight client in the GO driver. The changes include the addition of OAuth access token support, implementation of token exchange and client credentials OAuth flows. ## Related Issues - Closes #[2650](apache#2650) ## Changes Made 1. Added `token` as a database option 1. Added support for [Token Exchange](https://datatracker.ietf.org/doc/html/rfc8693). If configured, `token` gets exchanged and the result is added to the `Authorization` header as a `Bearer` token 1. Added support for [Client Credentials](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4). If configured, `client_id` and `client_secret` are used to obtain a access token that is added to the `Authorization` header as a `Bearer` token 1. Added new driver options to allow third-party applications to configure oauth flows: 1. Added tests Here's the markdown code for the OAuth 2.0 configuration options table: markdown# OAuth 2.0 Configuration Options | Option | Description | |--------|-------------| | `adbc.flight.sql.oauth.flow` | Specifies the OAuth 2.0 flow type to use. Possible values: `client_credentials`, `token_exchange` | | `adbc.flight.sql.oauth.client_id` | Unique identifier issued to the client application by the authorization server | | `adbc.flight.sql.oauth.client_secret` | Secret associated to the client_id. Used to authenticate the client application to the authorization server | | `adbc.flight.sql.oauth.token_uri` | The endpoint URL where the client application requests tokens from the authorization server | | `adbc.flight.sql.oauth.scope` | Space-separated list of permissions that the client is requesting access to (e.g `"read.all offline_access"`) | | `adbc.flight.sql.oauth.exchange.subject_token` | The security token that the client application wants to exchange | | `adbc.flight.sql.oauth.exchange.subject_token_type` | Identifier for the type of the subject token. Check list below for supported token types. | | `adbc.flight.sql.oauth.exchange.actor_token` | A security token that represents the identity of the acting party | | `adbc.flight.sql.oauth.exchange.actor_token_type` | Identifier for the type of the actor token. Check list below for supported token types. | | `adbc.flight.sql.oauth.exchange.aud` | The intended audience for the requested security token | | `adbc.flight.sql.oauth.exchange.resource` | The resource server where the client intends to use the requested security token | | `adbc.flight.sql.oauth.exchange.scope` | Specific permissions requested for the new token | | `adbc.flight.sql.oauth.exchange.requested_token_type` | The type of token the client wants to receive in exchange. Check list below for supported token types. | **Supported token types:** * `urn:ietf:params:oauth:token-type:access_token` * `urn:ietf:params:oauth:token-type:refresh_token` * `urn:ietf:params:oauth:token-type:id_token` * `urn:ietf:params:oauth:token-type:saml1` * `urn:ietf:params:oauth:token-type:saml2` * `urn:ietf:params:oauth:token-type:jwt`
1 parent 7f1dfca commit 2ea2fcb

File tree

5 files changed

+650
-32
lines changed

5 files changed

+650
-32
lines changed

docs/source/driver/flight_sql.rst

Lines changed: 64 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,12 @@ few optional authentication schemes:
159159
header will then be sent back as the ``authorization`` header on all
160160
future requests.
161161

162+
- OAuth 2.0 authentication flows.
163+
164+
The client provides :ref:`configurations <oauth-configurations>` to allow client application to obtain access
165+
tokens from an authorization server. The obtained token is then used
166+
on the ``authorization`` header on all future requests.
167+
162168
Bulk Ingestion
163169
--------------
164170

@@ -246,10 +252,67 @@ to :c:struct:`AdbcDatabase`, :c:struct:`AdbcConnection`, and
246252
Add the header ``<HEADER NAME>`` to outgoing requests with the given
247253
value.
248254

249-
Python: :attr:`adbc_driver_flightsql.ConnectionOptions.RPC_CALL_HEADER_PREFIX`
255+
Python: :attr:`adbc_driver_flightsql.ConnectionOptions.RPC_CALL_HEADER_PREFIX`
250256

251257
.. warning:: Header names must be in all lowercase.
252258

259+
260+
OAuth 2.0 Options
261+
-----------------------
262+
.. _oauth-configurations:
263+
264+
Supported configurations to obtain tokens using OAuth 2.0 authentication flows.
265+
266+
``adbc.flight.sql.oauth.flow``
267+
Specifies the OAuth 2.0 flow type to use. Possible values: ``client_credentials``, ``token_exchange``
268+
269+
``adbc.flight.sql.oauth.client_id``
270+
Unique identifier issued to the client application by the authorization server
271+
272+
``adbc.flight.sql.oauth.client_secret``
273+
Secret associated to the client_id. Used to authenticate the client application to the authorization server
274+
275+
``adbc.flight.sql.oauth.token_uri``
276+
The endpoint URL where the client application requests tokens from the authorization server
277+
278+
``adbc.flight.sql.oauth.scope``
279+
Space-separated list of permissions that the client is requesting access to (e.g ``"read.all offline_access"``)
280+
281+
``adbc.flight.sql.oauth.exchange.subject_token``
282+
The security token that the client application wants to exchange
283+
284+
``adbc.flight.sql.oauth.exchange.subject_token_type``
285+
Identifier for the type of the subject token.
286+
Check list below for supported token types.
287+
288+
``adbc.flight.sql.oauth.exchange.actor_token``
289+
A security token that represents the identity of the acting party
290+
291+
``adbc.flight.sql.oauth.exchange.actor_token_type``
292+
Identifier for the type of the actor token.
293+
Check list below for supported token types.
294+
``adbc.flight.sql.oauth.exchange.aud``
295+
The intended audience for the requested security token
296+
297+
``adbc.flight.sql.oauth.exchange.resource``
298+
The resource server where the client intends to use the requested security token
299+
300+
``adbc.flight.sql.oauth.exchange.scope``
301+
Specific permissions requested for the new token
302+
303+
``adbc.flight.sql.oauth.exchange.requested_token_type``
304+
The type of token the client wants to receive in exchange.
305+
Check list below for supported token types.
306+
307+
308+
Supported token types:
309+
- ``urn:ietf:params:oauth:token-type:access_token``
310+
- ``urn:ietf:params:oauth:token-type:refresh_token``
311+
- ``urn:ietf:params:oauth:token-type:id_token``
312+
- ``urn:ietf:params:oauth:token-type:saml1``
313+
- ``urn:ietf:params:oauth:token-type:saml2``
314+
- ``urn:ietf:params:oauth:token-type:jwt``
315+
253316
Distributed Result Sets
254317
-----------------------
255318

0 commit comments

Comments
 (0)