Skip to content

Commit 40c0a73

Browse files
talatuyarertalatuyarer
authored
GCP: Add Google Authentication Support (#13212)
* Initial Version of GCPAuthManager
1 parent feeb045 commit 40c0a73

5 files changed

Lines changed: 602 additions & 0 deletions

File tree

‎build.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -718,6 +718,7 @@ project(':iceberg-gcp') {
718718
testImplementation libs.esotericsoftware.kryo
719719
testImplementation libs.mockserver.netty
720720
testImplementation libs.mockserver.client.java
721+
testImplementation libs.mockito.junit.jupiter
721722
}
722723
}
723724

‎gcp/src/main/java/org/apache/iceberg/gcp/auth/GoogleAuthManager.java‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
package org.apache.iceberg.gcp.auth;
20+
21+
import com.google.auth.oauth2.GoogleCredentials;
22+
import java.io.FileInputStream;
23+
import java.io.IOException;
24+
import java.io.UncheckedIOException;
25+
import java.util.List;
26+
import java.util.Map;
27+
import org.apache.iceberg.catalog.SessionCatalog;
28+
import org.apache.iceberg.catalog.TableIdentifier;
29+
import org.apache.iceberg.relocated.com.google.common.base.Preconditions;
30+
import org.apache.iceberg.relocated.com.google.common.base.Splitter;
31+
import org.apache.iceberg.relocated.com.google.common.base.Strings;
32+
import org.apache.iceberg.relocated.com.google.common.collect.ImmutableList;
33+
import org.apache.iceberg.rest.RESTClient;
34+
import org.apache.iceberg.rest.auth.AuthManager;
35+
import org.apache.iceberg.rest.auth.AuthSession;
36+
import org.slf4j.Logger;
37+
import org.slf4j.LoggerFactory;
38+
39+
/**
40+
* An authentication manager that uses Google Credentials (typically Application Default
41+
* Credentials) to create {@link GoogleAuthSession} instances.
42+
*
43+
* <p>This manager can be configured with properties such as:
44+
*
45+
* <ul>
46+
* <li>{@code gcp.auth.credentials-path}: Path to a service account JSON key file. If not set,
47+
* Application Default Credentials will be used.
48+
* <li>{@code gcp.auth.scopes}: Comma-separated list of OAuth scopes to request. Defaults to
49+
* "https://www.googleapis.com/auth/cloud-platform".
50+
* </ul>
51+
*/
52+
public class GoogleAuthManager implements AuthManager {
53+
private static final Logger LOG = LoggerFactory.getLogger(GoogleAuthManager.class);
54+
private static final Splitter SPLITTER = Splitter.on(',').trimResults().omitEmptyStrings();
55+
public static final String DEFAULT_SCOPES = "https://www.googleapis.com/auth/cloud-platform";
56+
public static final String GCP_CREDENTIALS_PATH_PROPERTY = "gcp.auth.credentials-path";
57+
public static final String GCP_SCOPES_PROPERTY = "gcp.auth.scopes";
58+
private final String name;
59+
60+
private GoogleCredentials credentials;
61+
private boolean initialized = false;
62+
63+
public GoogleAuthManager(String managerName) {
64+
this.name = managerName;
65+
}
66+
67+
public String name() {
68+
return name;
69+
}
70+
71+
private void initialize(Map<String, String> properties) {
72+
if (initialized) {
73+
return;
74+
}
75+
76+
String credentialsPath = properties.get(GCP_CREDENTIALS_PATH_PROPERTY);
77+
String scopesString = properties.getOrDefault(GCP_SCOPES_PROPERTY, DEFAULT_SCOPES);
78+
List<String> scopes =
79+
Strings.isNullOrEmpty(scopesString)
80+
? ImmutableList.of()
81+
: ImmutableList.copyOf(SPLITTER.splitToList(scopesString));
82+
83+
try {
84+
if (credentialsPath != null && !credentialsPath.isEmpty()) {
85+
LOG.info("Using Google credentials from path: {}", credentialsPath);
86+
try (FileInputStream credentialsStream = new FileInputStream(credentialsPath)) {
87+
this.credentials = GoogleCredentials.fromStream(credentialsStream).createScoped(scopes);
88+
}
89+
} else {
90+
LOG.info("Using Application Default Credentials with scopes: {}", scopesString);
91+
this.credentials = GoogleCredentials.getApplicationDefault().createScoped(scopes);
92+
}
93+
} catch (IOException e) {
94+
throw new UncheckedIOException("Failed to load Google credentials", e);
95+
}
96+
97+
this.initialized = true;
98+
}
99+
100+
/**
101+
* Initializes and returns a short-lived session, typically for fetching configuration. This
102+
* implementation reuses the long-lived catalog session logic.
103+
*/
104+
@Override
105+
public AuthSession initSession(RESTClient initClient, Map<String, String> properties) {
106+
return catalogSession(initClient, properties);
107+
}
108+
109+
/**
110+
* Returns a long-lived session tied to the catalog's lifecycle. This session uses Google
111+
* Application Default Credentials or a specified service account.
112+
*
113+
* @param sharedClient The long-lived RESTClient (not used by this implementation for credential
114+
* fetching).
115+
* @param properties Configuration properties for the auth manager.
116+
* @return A {@link GoogleAuthSession}.
117+
* @throws UncheckedIOException if credential loading fails.
118+
*/
119+
@Override
120+
public AuthSession catalogSession(RESTClient sharedClient, Map<String, String> properties) {
121+
initialize(properties);
122+
Preconditions.checkState(
123+
credentials != null, "GoogleAuthManager not initialized or failed to load credentials");
124+
return new GoogleAuthSession(credentials);
125+
}
126+
127+
/**
128+
* Returns a session for a specific context. Defaults to the catalog session. For GCP, tokens are
129+
* typically not context-specific in this manner.
130+
*/
131+
@Override
132+
public AuthSession contextualSession(SessionCatalog.SessionContext context, AuthSession parent) {
133+
return parent;
134+
}
135+
136+
/** Returns a session for a specific table or view. Defaults to the catalog session. */
137+
@Override
138+
public AuthSession tableSession(
139+
TableIdentifier table, Map<String, String> properties, AuthSession parent) {
140+
return parent;
141+
}
142+
143+
/** Closes the manager. This is a no-op for GoogleAuthManager. */
144+
@Override
145+
public void close() {}
146+
}

‎gcp/src/main/java/org/apache/iceberg/gcp/auth/GoogleAuthSession.java‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
package org.apache.iceberg.gcp.auth;
20+
21+
import com.google.auth.oauth2.AccessToken;
22+
import com.google.auth.oauth2.GoogleCredentials;
23+
import java.io.IOException;
24+
import java.io.UncheckedIOException;
25+
import org.apache.iceberg.relocated.com.google.common.base.Preconditions;
26+
import org.apache.iceberg.rest.HTTPHeaders;
27+
import org.apache.iceberg.rest.HTTPRequest;
28+
import org.apache.iceberg.rest.ImmutableHTTPRequest;
29+
import org.apache.iceberg.rest.auth.AuthSession;
30+
import org.slf4j.Logger;
31+
import org.slf4j.LoggerFactory;
32+
33+
/**
34+
* An authentication session that uses Google Credentials (typically Application Default
35+
* Credentials) to obtain an OAuth2 access token and add it to HTTP requests.
36+
*/
37+
class GoogleAuthSession implements AuthSession {
38+
private static final Logger LOG = LoggerFactory.getLogger(GoogleAuthSession.class);
39+
private final GoogleCredentials credentials;
40+
41+
/**
42+
* Constructs a GoogleAuthSession with the provided GoogleCredentials.
43+
*
44+
* @param credentials The GoogleCredentials to use for authentication.
45+
*/
46+
GoogleAuthSession(GoogleCredentials credentials) {
47+
Preconditions.checkArgument(credentials != null, "Invalid credentials: null");
48+
this.credentials = credentials;
49+
}
50+
51+
/**
52+
* Authenticates the given HTTP request by adding an "Authorization: Bearer token" header. The
53+
* access token is obtained from the GoogleCredentials.
54+
*
55+
* @param request The HTTPRequest to authenticate.
56+
* @return A new HTTPRequest with the added Authorization header.
57+
* @throws UncheckedIOException if an IOException occurs while refreshing the access token.
58+
*/
59+
@Override
60+
public HTTPRequest authenticate(HTTPRequest request) {
61+
try {
62+
credentials.refreshIfExpired();
63+
AccessToken token = credentials.getAccessToken();
64+
65+
if (token != null && token.getTokenValue() != null) {
66+
HTTPHeaders newHeaders =
67+
request
68+
.headers()
69+
.putIfAbsent(
70+
HTTPHeaders.of(
71+
HTTPHeaders.HTTPHeader.of(
72+
"Authorization", "Bearer " + token.getTokenValue())));
73+
return newHeaders.equals(request.headers())
74+
? request
75+
: ImmutableHTTPRequest.builder().from(request).headers(newHeaders).build();
76+
} else {
77+
throw new IllegalStateException(
78+
"Failed to obtain Google access token. Cannot authenticate request.");
79+
}
80+
} catch (IOException e) {
81+
LOG.error("IOException while trying to refresh Google access token", e);
82+
throw new UncheckedIOException("Failed to refresh Google access token", e);
83+
}
84+
}
85+
86+
/**
87+
* Closes the session. This is a no-op for GoogleAuthSession as the lifecycle of GoogleCredentials
88+
* is not managed by this session.
89+
*/
90+
@Override
91+
public void close() {
92+
// No-op
93+
}
94+
}

0 commit comments

Comments
 (0)