feat(token-exchange): read subject/actor tokens from local files (#207)

Fixes #206.

Author: anleib

docs/configuration.md

@@ -309,7 +309,15 @@ See the [Token Exchange](./token-exchange.md) section for more details.
 
 The subject token to exchange.
 
-If this value is present, the subject token will be used as-is. If this value is not present, the subject token will be dynamically fetched using the configuration provided under the `rest.auth.oauth2.token-exchange.subject-token` prefix.
+If this value is present, the subject token will be used as-is. If this value is not present, the subject token may be read from the file specified by `rest.auth.oauth2.token-exchange.subject-token-file`, or dynamically fetched using the configuration provided under the `rest.auth.oauth2.token-exchange.subject-token` prefix.
+
+### `rest.auth.oauth2.token-exchange.subject-token-file`
+
+Path to a file containing the subject token. The file content is read and trimmed to obtain the token value. Ignored if `rest.auth.oauth2.token-exchange.subject-token` is set. If this is the only static source and neither inline token nor dynamic config is provided, the file must exist and be readable at configuration load time.
+
+### `rest.auth.oauth2.token-exchange.actor-token-file`
+
+Path to a file containing the actor token. The file content is read and trimmed to obtain the token value. Ignored if `rest.auth.oauth2.token-exchange.actor-token` is set. If this is the only static source and neither inline token nor dynamic config is provided, the file must exist and be readable at configuration load time.
 
 ### `rest.auth.oauth2.token-exchange.subject-token-type`
 

docs/token-exchange.md

@@ -36,8 +36,17 @@ Specifically, it enables subject and actor tokens to be provided in two methods:
 Static subject and actor tokens are provided in the configuration using the following properties,
 respectively:
 
-* `rest.auth.oauth2.token-exchange.subject-token`
-* `rest.auth.oauth2.token-exchange.actor-token`
+* `rest.auth.oauth2.token-exchange.subject-token` — the inline token value
+* `rest.auth.oauth2.token-exchange.subject-token-file` — path to a file whose content (read and
+  trimmed) is used as the subject token; ignored if `subject-token` is set
+* `rest.auth.oauth2.token-exchange.actor-token` — the inline token value
+* `rest.auth.oauth2.token-exchange.actor-token-file` — path to a file whose content (read and
+  trimmed) is used as the actor token; ignored if `actor-token` is set
+
+The subject token is taken from the inline `subject-token` if set, otherwise from the file at
+`subject-token-file` if set, otherwise from dynamic configuration under `subject-token.*`. \
+Similarly, the actor token is taken from the inline `actor-token` if set, otherwise from the file at
+`actor-token-file` if set, otherwise from dynamic configuration under `actor-token.*`.
 
 Additionally, the type of the subject and actor tokens can be specified using the following
 properties, respectively:
@@ -59,10 +68,16 @@ rest.auth.oauth2.scope=catalog1
 
 # Subject token settings
 rest.auth.oauth2.token-exchange.subject-token=$SUBJECT_TOKEN
+# Alternatively, the subject token can be read from a local file
+# (instead of subject-token=...) If both are set, subject-token takes precedence.
+rest.auth.oauth2.token-exchange.subject-token-file=/path/to/subject-token
 rest.auth.oauth2.token-exchange.subject-token-type=urn:ietf:params:oauth:token-type:jwt
 
 # Actor token settings
 rest.auth.oauth2.token-exchange.actor-token=$ACTOR_TOKEN
+# Alternatively, the actor token can be read from a local file
+# (instead of actor-token=...) If both are set, actor-token takes precedence.
+rest.auth.oauth2.token-exchange.actor-token-file=/path/to/actor-token
 rest.auth.oauth2.token-exchange.actor-token-type=urn:ietf:params:oauth:token-type:jwt
 ```
 
@@ -73,7 +88,9 @@ token exchange is performed using the primary IDP, which is configured using the
 ### Using Dynamic Tokens
 
 To enable dynamic fetching of tokens, the `rest.auth.oauth2.token-exchange.subject-token` and
-`rest.auth.oauth2.token-exchange.actor-token` properties must _not_ be set.
+`rest.auth.oauth2.token-exchange.subject-token-file` properties must _not_ be set for the subject
+token, and `rest.auth.oauth2.token-exchange.actor-token` and
+`rest.auth.oauth2.token-exchange.actor-token-file` must _not_ be set for the actor token.
 
 Then, details for the subject and actor token fetch must be provided under the following prefixes,
 respectively:

oauth2/core/src/main/java/com/dremio/iceberg/authmgr/oauth2/config/TokenExchangeConfig.java

@@ -16,12 +16,15 @@
 package com.dremio.iceberg.authmgr.oauth2.config;
 
 import com.dremio.iceberg.authmgr.oauth2.OAuth2Config;
+import com.dremio.iceberg.authmgr.oauth2.config.validator.ConfigValidator;
 import com.nimbusds.oauth2.sdk.id.Audience;
 import com.nimbusds.oauth2.sdk.token.TokenTypeURI;
 import com.nimbusds.oauth2.sdk.token.TypelessAccessToken;
 import io.smallrye.config.WithDefault;
 import io.smallrye.config.WithName;
 import java.net.URI;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -41,8 +44,10 @@ public interface TokenExchangeConfig {
   String PREFIX = OAuth2Config.PREFIX + '.' + GROUP_NAME;
 
   String SUBJECT_TOKEN = "subject-token";
+  String SUBJECT_TOKEN_FILE = "subject-token-file";
   String SUBJECT_TOKEN_TYPE = "subject-token-type";
   String ACTOR_TOKEN = "actor-token";
+  String ACTOR_TOKEN_FILE = "actor-token-file";
   String ACTOR_TOKEN_TYPE = "actor-token-type";
   String REQUESTED_TOKEN_TYPE = "requested-token-type";
   String RESOURCE = "resource";
@@ -54,12 +59,31 @@ public interface TokenExchangeConfig {
    * The subject token to exchange.
    *
    * <p>If this value is present, the subject token will be used as-is. If this value is not
-   * present, the subject token will be dynamically fetched using the configuration provided under
-   * the {@value #SUBJECT_TOKEN} prefix.
+   * present, the subject token may be read from the file specified by {@value #SUBJECT_TOKEN_FILE},
+   * or dynamically fetched using the configuration provided under the {@value #SUBJECT_TOKEN}
+   * prefix.
    */
   @WithName(SUBJECT_TOKEN)
   Optional<TypelessAccessToken> getSubjectToken();
 
+  /**
+   * Path to a file containing the subject token. The file content is read and trimmed to obtain the
+   * token value. Ignored if {@value #SUBJECT_TOKEN} is set. If this is the only static source and
+   * neither inline token nor dynamic config is provided, the file must exist and be readable at
+   * configuration load time.
+   */
+  @WithName(SUBJECT_TOKEN_FILE)
+  Optional<Path> getSubjectTokenFile();
+
+  /**
+   * Path to a file containing the actor token. The file content is read and trimmed to obtain the
+   * token value. Ignored if {@value #ACTOR_TOKEN} is set. If this is the only static source and
+   * neither inline token nor dynamic config is provided, the file must exist and be readable at
+   * configuration load time.
+   */
+  @WithName(ACTOR_TOKEN_FILE)
+  Optional<Path> getActorTokenFile();
+
   /**
    * The type of the subject token. Must be a valid URN. The default is {@code
    * urn:ietf:params:oauth:token-type:access_token}.
@@ -174,6 +198,25 @@ public interface TokenExchangeConfig {
   Optional<List<Audience>> getAudience();
 
   default void validate() {
-    // No validation needed
+    ConfigValidator validator = new ConfigValidator();
+    validateTokenFile(
+        validator,
+        getSubjectToken().isEmpty(),
+        getSubjectTokenFile().orElse(null),
+        SUBJECT_TOKEN_FILE);
+    validateTokenFile(
+        validator, getActorToken().isEmpty(), getActorTokenFile().orElse(null), ACTOR_TOKEN_FILE);
+    validator.validate();
+  }
+
+  private static void validateTokenFile(
+      ConfigValidator validator, boolean inlineTokenAbsent, Path tokenFilePath, String fileKey) {
+    if (inlineTokenAbsent && tokenFilePath != null) {
+      validator.check(
+          Files.isReadable(tokenFilePath),
+          PREFIX + '.' + fileKey,
+          "token-exchange: '%s' is not a file or is not readable",
+          tokenFilePath);
+    }
   }
 }

oauth2/core/src/main/java/com/dremio/iceberg/authmgr/oauth2/tokenexchange/AbstractTokenSupplier.java

@@ -27,6 +27,10 @@
 import com.nimbusds.oauth2.sdk.token.TokenTypeURI;
 import com.nimbusds.oauth2.sdk.token.TypelessAccessToken;
 import jakarta.annotation.Nullable;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Optional;
@@ -91,6 +95,23 @@ protected OAuth2Agent getTokenAgent() {
     return new OAuth2Agent(tokenAgentConfig, getRuntime());
   }
 
+  /**
+   * Reads a token from a file. The file content is read as UTF-8 and trimmed of leading and
+   * trailing whitespace; the result is returned as a {@link TypelessAccessToken}.
+   *
+   * @param path path to the file containing the token
+   * @return the token parsed from the file
+   * @throws UncheckedIOException if the file cannot be read
+   */
+  protected static TypelessAccessToken readTokenFromFile(Path path) {
+    try {
+      String value = Files.readString(path).strip();
+      return new TypelessAccessToken(value);
+    } catch (IOException e) {
+      throw new UncheckedIOException("Failed to read token from file: " + path, e);
+    }
+  }
+
   @Override
   public void close() {
     if (getTokenAgent() != null) {

oauth2/core/src/main/java/com/dremio/iceberg/authmgr/oauth2/tokenexchange/ActorTokenSupplier.java

@@ -17,6 +17,7 @@
 
 import com.dremio.iceberg.authmgr.oauth2.OAuth2Config;
 import com.dremio.iceberg.authmgr.oauth2.agent.OAuth2AgentRuntime;
+import com.dremio.iceberg.authmgr.oauth2.config.TokenExchangeConfig;
 import com.dremio.iceberg.authmgr.tools.immutables.AuthManagerImmutable;
 import com.nimbusds.oauth2.sdk.token.TokenTypeURI;
 import com.nimbusds.oauth2.sdk.token.TypelessAccessToken;
@@ -41,7 +42,12 @@ public ActorTokenSupplier copy() {
 
   @Override
   protected Optional<TypelessAccessToken> getStaticToken() {
-    return getMainConfig().getTokenExchangeConfig().getActorToken();
+    TokenExchangeConfig tokenExchangeConfig = getMainConfig().getTokenExchangeConfig();
+    return tokenExchangeConfig
+        .getActorToken()
+        .or(
+            () ->
+                tokenExchangeConfig.getActorTokenFile().map(ActorTokenSupplier::readTokenFromFile));
   }
 
   @Override

oauth2/core/src/main/java/com/dremio/iceberg/authmgr/oauth2/tokenexchange/SubjectTokenSupplier.java

@@ -17,6 +17,7 @@
 
 import com.dremio.iceberg.authmgr.oauth2.OAuth2Config;
 import com.dremio.iceberg.authmgr.oauth2.agent.OAuth2AgentRuntime;
+import com.dremio.iceberg.authmgr.oauth2.config.TokenExchangeConfig;
 import com.dremio.iceberg.authmgr.tools.immutables.AuthManagerImmutable;
 import com.nimbusds.oauth2.sdk.token.TokenTypeURI;
 import com.nimbusds.oauth2.sdk.token.TypelessAccessToken;
@@ -50,7 +51,14 @@ protected void validate() {
 
   @Override
   protected Optional<TypelessAccessToken> getStaticToken() {
-    return getMainConfig().getTokenExchangeConfig().getSubjectToken();
+    TokenExchangeConfig tokenExchangeConfig = getMainConfig().getTokenExchangeConfig();
+    return tokenExchangeConfig
+        .getSubjectToken()
+        .or(
+            () ->
+                tokenExchangeConfig
+                    .getSubjectTokenFile()
+                    .map(SubjectTokenSupplier::readTokenFromFile));
   }
 
   @Override

oauth2/core/src/test/java/com/dremio/iceberg/authmgr/oauth2/config/TokenExchangeConfigTest.java

@@ -15,22 +15,65 @@
  */
 package com.dremio.iceberg.authmgr.oauth2.config;
 
+import static com.dremio.iceberg.authmgr.oauth2.config.TokenExchangeConfig.ACTOR_TOKEN_FILE;
 import static com.dremio.iceberg.authmgr.oauth2.config.TokenExchangeConfig.AUDIENCE;
 import static com.dremio.iceberg.authmgr.oauth2.config.TokenExchangeConfig.PREFIX;
 import static com.dremio.iceberg.authmgr.oauth2.config.TokenExchangeConfig.SUBJECT_TOKEN;
+import static com.dremio.iceberg.authmgr.oauth2.config.TokenExchangeConfig.SUBJECT_TOKEN_FILE;
+import static java.util.Collections.singletonList;
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 
+import com.dremio.iceberg.authmgr.oauth2.config.validator.ConfigValidator;
 import com.google.common.collect.ImmutableMap;
 import com.nimbusds.oauth2.sdk.id.Audience;
 import io.smallrye.config.SmallRyeConfig;
 import io.smallrye.config.SmallRyeConfigBuilder;
 import io.smallrye.config.common.MapBackedConfigSource;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Stream;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
 class TokenExchangeConfigTest {
 
+  @ParameterizedTest
+  @MethodSource
+  void testValidate(Map<String, String> properties, List<String> expected) {
+    SmallRyeConfig smallRyeConfig =
+        new SmallRyeConfigBuilder()
+            .withMapping(TokenExchangeConfig.class, PREFIX)
+            .withSources(new MapBackedConfigSource("catalog-properties", properties, 1000) {})
+            .build();
+    TokenExchangeConfig config = smallRyeConfig.getConfigMapping(TokenExchangeConfig.class, PREFIX);
+    assertThatIllegalArgumentException()
+        .isThrownBy(config::validate)
+        .withMessage(ConfigValidator.buildDescription(expected.stream()));
+  }
+
+  static Stream<Arguments> testValidate() {
+    return Stream.of(
+        Arguments.of(
+            Map.of(PREFIX + '.' + SUBJECT_TOKEN_FILE, "/invalid/subject-token-file"),
+            singletonList(
+                "token-exchange: '/invalid/subject-token-file' is not a file or is not readable ("
+                    + PREFIX
+                    + '.'
+                    + SUBJECT_TOKEN_FILE
+                    + ")")),
+        Arguments.of(
+            Map.of(PREFIX + '.' + ACTOR_TOKEN_FILE, "/invalid/actor-token-file"),
+            singletonList(
+                "token-exchange: '/invalid/actor-token-file' is not a file or is not readable ("
+                    + PREFIX
+                    + '.'
+                    + ACTOR_TOKEN_FILE
+                    + ")")));
+  }
+
   @Test
   void testAudienceEmpty() {
     Map<String, String> properties =

oauth2/core/src/test/java/com/dremio/iceberg/authmgr/oauth2/tokenexchange/ActorTokenSupplierTest.java

@@ -28,19 +28,22 @@
 import com.nimbusds.oauth2.sdk.token.AccessToken;
 import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
 import com.nimbusds.oauth2.sdk.token.TokenTypeURI;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.Map;
 import java.util.concurrent.CompletionStage;
 import java.util.concurrent.ScheduledExecutorService;
 import org.assertj.core.api.junit.jupiter.SoftAssertionsExtension;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
 
 @ExtendWith(SoftAssertionsExtension.class)
 class ActorTokenSupplierTest {
 
   @Test
   void testSupplyActorTokenAsyncStatic() {
-    OAuth2Config config = createMainConfig("actor-token", TokenTypeURI.ID_TOKEN, Map.of());
+    OAuth2Config config = createMainConfig("actor-token", null, TokenTypeURI.ID_TOKEN, Map.of());
     try (ActorTokenSupplier supplier = createSupplier(config)) {
       CompletionStage<AccessToken> stage = supplier.supplyTokenAsync();
       assertThat(stage)
@@ -53,6 +56,7 @@ void testSupplyActorTokenAsyncStatic() {
   void testSupplyActorTokenAsyncDynamic() {
     OAuth2Config config =
         createMainConfig(
+            null,
             null,
             TokenTypeURI.ACCESS_TOKEN,
             Map.of(
@@ -72,15 +76,31 @@ void testSupplyActorTokenAsyncDynamic() {
 
   @Test
   void testSupplyActorTokenAsyncNull() {
-    OAuth2Config config = createMainConfig(null, TokenTypeURI.ACCESS_TOKEN, Map.of());
+    OAuth2Config config = createMainConfig(null, null, TokenTypeURI.ACCESS_TOKEN, Map.of());
     try (ActorTokenSupplier supplier = createSupplier(config)) {
       CompletionStage<AccessToken> stage = supplier.supplyTokenAsync();
       assertThat(stage).isCompletedWithValue(null);
     }
   }
 
+  @Test
+  void testSupplyActorTokenAsyncFromFile(@TempDir Path tempDir) throws Exception {
+    Path tokenFile = tempDir.resolve("actor-token.txt");
+    Files.writeString(tokenFile, "  actor-token-from-file  ");
+    OAuth2Config config = createMainConfig(null, tokenFile, TokenTypeURI.JWT, Map.of());
+    try (ActorTokenSupplier supplier = createSupplier(config)) {
+      CompletionStage<AccessToken> stage = supplier.supplyTokenAsync();
+      assertThat(stage)
+          .isCompletedWithValue(
+              new BearerAccessToken("actor-token-from-file", 0, null, TokenTypeURI.JWT));
+    }
+  }
+
   private static OAuth2Config createMainConfig(
-      String actorToken, TokenTypeURI actorTokenType, Map<String, String> actorTokenConfig) {
+      String actorToken,
+      Path actorTokenFile,
+      TokenTypeURI actorTokenType,
+      Map<String, String> actorTokenConfig) {
 
     ImmutableMap.Builder<String, String> builder = ImmutableMap.builder();
 
@@ -103,6 +123,11 @@ private static OAuth2Config createMainConfig(
     if (actorToken != null) {
       builder.put(TokenExchangeConfig.PREFIX + '.' + TokenExchangeConfig.ACTOR_TOKEN, actorToken);
     }
+    if (actorTokenFile != null) {
+      builder.put(
+          TokenExchangeConfig.PREFIX + '.' + TokenExchangeConfig.ACTOR_TOKEN_FILE,
+          actorTokenFile.toString());
+    }
 
     return OAuth2Config.from(builder.build());
   }