fix: Fix Bearer authentication with Nessie catalog #26512
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
denodo-research-labs
requested review from
a team,
ZacBlanco and
hantangwangd
as code owners
Reviewer's GuideThis PR implements support for Bearer authentication with the Nessie catalog by extending the testing infrastructure to spin up a Keycloak server, propagating the authentication type through the catalog factory, and validating the workflow with a new integration test. Sequence diagram for Bearer authentication workflow with Nessie catalogsequenceDiagram
participant Test as "TestIcebergSystemTablesNessieWithBearerAuth"
participant Keycloak as "KeycloakContainer"
participant Nessie as "NessieContainer"
participant Catalog as "IcebergNessieCatalogFactory"
Test->>Keycloak: Request access token
Keycloak-->>Test: Return Bearer token
Test->>Catalog: Pass Bearer token and authentication type
Catalog->>Nessie: Connect using Bearer authentication
Nessie-->>Catalog: Authentication success
Catalog-->>Test: Connection established
Entity relationship diagram for Keycloak and Nessie containerserDiagram
KEYCLOAK {
string admin_username
string admin_password
int port
string server_url
}
NESSIE {
int port
string version_store_type
}
KEYCLOAK ||--o| NESSIE : "provides Bearer token for"
NESSIE {
string authentication_type
}
Class diagram for new KeycloakContainer and related changesclassDiagram
class KeycloakContainer {
+DEFAULT_IMAGE : String
+DEFAULT_HOST_NAME : String
+DEFAULT_USER_NAME : String
+DEFAULT_PASSWORD : String
+PORT : int
+SERVER_URL : String
+getUrl() : String
+getAccessToken() : String
+start()
+setupContainer()
}
class BaseTestContainer {
}
class KeycloakContainer.Builder {
+build() : KeycloakContainer
}
KeycloakContainer --|> BaseTestContainer
KeycloakContainer.Builder --|> BaseTestContainer.Builder
KeycloakContainer.Builder --> KeycloakContainer
class NessieContainer {
+DEFAULT_ENV_VARS : ImmutableMap<String, String>
}
NessieContainer.Builder --> NessieContainer
class IcebergNessieCatalogFactory {
+getCatalogProperties(session)
}
IcebergNessieCatalogFactory o-- CatalogConfig : catalogConfig
class TestIcebergSystemTablesNessieWithBearerAuth {
}
TestIcebergSystemTablesNessieWithBearerAuth --|> TestIcebergSystemTablesNessie
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `presto-testing-docker/src/main/java/com/facebook/presto/testing/containers/KeycloakContainer.java:102` </location>
<code_context>
+ RealmRepresentation masterRep = master.toRepresentation();
+ // change access token lifespan from 1 minute (default) to 1 hour
+ // to keep the token alive in case testcase takes more than a minute to finish execution.
+ masterRep.setAccessTokenLifespan(3600);
+ master.update(masterRep);
+ return keycloak.tokenManager().grantToken().getToken();
</code_context>
<issue_to_address>
**issue (bug_risk):** Changing the access token lifespan on every token request may have unintended side effects.
Setting the access token lifespan within getAccessToken() can cause race conditions in concurrent tests. It's better to configure this during container setup or initialization.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| RealmRepresentation masterRep = master.toRepresentation(); | ||
| // change access token lifespan from 1 minute (default) to 1 hour | ||
| // to keep the token alive in case testcase takes more than a minute to finish execution. | ||
| masterRep.setAccessTokenLifespan(3600); |
There was a problem hiding this comment.
issue (bug_risk): Changing the access token lifespan on every token request may have unintended side effects.
Setting the access token lifespan within getAccessToken() can cause race conditions in concurrent tests. It's better to configure this during container setup or initialization.
denodo-research-labs
force-pushed
the
bearer_authentication_nessie_catalog
branch
2 times, most recently
from
1e8efab to
45f4a0b
Compare
denodo-research-labs
force-pushed
the
bearer_authentication_nessie_catalog
branch
from
45f4a0b to
f5c6fe6
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Bearer authentication for Nessie catalog is not working
Motivation and Context
Fixes the problem with Bearer authentication for Nessie catalog
Impact
Is not possible to connect to Nessie catalog using Bearer authentication
Test Plan
A new TestIcebergSystemTablesNessieWithBearerAuth class has been added. It extends TestIcebergSystemTablesNessie and re-runs those tests using Bearer authentication. The other Nessie tests are not duplicated, as this class sufficiently validates the authentication mechanism.
Contributor checklist
Release Notes
Please follow release notes guidelines and fill in the release notes below.