Enable Extra-Credential Support for Iceberg Oauth Token & Credential

[git-rbanerjee]

Enable extra-credential support for Iceberg Oauth tokens or credentials so users can connect to Trino using their own OAuth tokens/credentials. This allows secure passthrough authentication from Trino to an Iceberg REST catalog (e.g., Polaris), aligning with modern security practices and user-managed token flows.

Problem of using iceberg.rest-catalog.session is described here.

Today, users need to configure credentials statically on the Trino side. With this feature, users will be able to bring their own time-limited credentials at query time.

Example session-level connection:

./trino \
  --server http://localhost:8080 \
  --extra-credential oauth_token="my1hrvalidtoken"

Example Connector Config

connector.name=iceberg
fs.native-s3.enabled=true
iceberg.catalog.type=rest
iceberg.rest-catalog.oauth2.credential=oauth_credential
iceberg.rest-catalog.oauth2.token=oauth_token
iceberg.rest-catalog.oauth2.scope=PRINCIPAL_ROLE\:admin
iceberg.rest-catalog.oauth2.server-uri=https://myorg/oauth/token
iceberg.rest-catalog.security=OAUTH2
iceberg.rest-catalog.uri=https://polaris/api/catalog
iceberg.rest-catalog.vended-credentials-enabled=true
iceberg.rest-catalog.warehouse=mywarehouse

[git-rbanerjee]

Even though there is some code

trino/plugin/trino-iceberg/src/main/java/io/trino/plugin/iceberg/catalog/rest/TrinoRestCatalog.java

Line 856 in c833da9

.putAll(session.getIdentity().getExtraCredentials())

which is using ExtraCredential but we cant send urn:ietf:params:oauth:token-type:access_token has header name as it contains colon in name.

[michal-kuzak]

Hi,

Is there any plan for implementing this ? I believe is is highly critical as the currently shared access to Iceberg is a no-go for any production setup and limits the usage scenario for Trino. The only current workaround is use multiple Trino instances for multiple teams/groups with is still partly shared but better then one global access.

Thanks

[lucianogreiner]

I have a patch for this. I will submit a PR soon

[xcontreras94]

I have a patch for this. I will submit a PR soon

@lucianogreiner were you able to submit a PR? Let me know if there's anything I can help with.

[louis-pie]

We are also waiting for this. Any way I can help?

[lucianogreiner]

#29538

[louis-pie]

Submitted #29758 to implement Allow OAuth2 authenticated user tokens to be used with Iceberg REST catalogs