[#11443] feat(auth): Add Basic auth support for Spark, Flink, and Trino connectors by lasdf1234 · Pull Request #11457 · apache/gravitino

lasdf1234 · 2026-06-05T09:17:56Z

What changes were proposed in this pull request?

Add HTTP Basic authentication support to the Spark, Flink, and Trino connectors so they can
authenticate against the Gravitino built-in IDP:

Spark: GravitinoSparkConfig properties and basic branch in
GravitinoDriverPlugin.createGravitinoClient().
Flink: basic auth in GravitinoCatalogManager and
GravitinoCatalogStoreFactoryOptions.
Trino: basic auth in GravitinoAuthProvider.
Docs: update Spark/Flink/Trino connector authentication documentation with Basic mode
configuration examples and supported auth types.

Why are the changes needed?

The built-in IDP requires HTTP Basic Authentication, but the Spark/Flink/Trino connectors only
supported simple, oauth2, and kerberos. Users could not connect through these connectors
with built-in IDP credentials even though the Java client already supports withBasicAuth().

Fix: #11443

Does this PR introduce any user-facing change?

Yes. New optional connector configuration for Basic auth:

Connector	Properties
Spark	`spark.sql.gravitino.authType=basic`, `spark.sql.gravitino.basic.username`, `spark.sql.gravitino.basic.password`
Flink	`table.catalog-store.gravitino.gravitino.client.auth.type=basic`, `table.catalog-store.gravitino.gravitino.client.basic.username`, `table.catalog-store.gravitino.gravitino.client.basic.password`
Trino	`gravitino.client.authType=basic`, `gravitino.client.basic.username`, `gravitino.client.basic.password`

When Flink table.catalog-store.gravitino.gravitino.client.auth.type is explicitly set, only
oauth2 and basic are supported.

How was this patch tested?

./gradlew :spark-connector:spark-common:test --tests "org.apache.gravitino.spark.connector.plugin.TestGravitinoSparkBasicAuth" -PskipITs
./gradlew :flink-connector:flink-common:test --tests "org.apache.gravitino.flink.connector.catalog.TestGravitinoCatalogManagerBasicAuth" -PskipITs
./gradlew :trino-connector:trino-connector:test --tests "org.apache.gravitino.trino.connector.security.TestGravitinoAuthProvider" -PskipITs
./gradlew :clients:client-java:test --tests "org.apache.gravitino.client.integration.test.authorization.BasicAuthOperationsIT" -PskipITs -PjdbcBackend=h2

…Trino Wire HTTP Basic authentication through Spark, Flink, and Trino connectors so clients can use the built-in IDP, and document the new configuration properties for each connector. Fix: apache#11443 Co-authored-by: Cursor <cursoragent@cursor.com>

…or-basic-auth Resolve documentation conflicts from the docs style sweep while keeping Basic authentication content for Spark, Flink, and Trino connectors. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

…p-basic test dep Replace isTransitive=false with module excludes so bcprov and other idp-basic transitives are retained while api, common, core, and server-common stay on the explicit connector test classpath. Co-authored-by: Cursor <cursoragent@cursor.com>

…le deps Clarify that explicitly setting gravitino.client.auth.type only supports oauth2 and basic in the Flink connector doc, and add spacing between the idp-basic and hive2 test dependencies in spark-common build.gradle.kts. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-06-05T12:01:57Z

Code Coverage Report

Overall Project	67.06% `-0.12%`	🟢
Files changed	40.99%	🔴

Module	Coverage
aliyun	1.72%	🔴
api	46.8%	🟢
authorization-common	85.96%	🟢
aws	3.66%	🔴
azure	2.47%	🔴
catalog-common	10.4% `-0.09%`	🔴
catalog-fileset	80.35%	🟢
catalog-glue	67.41%	🟢
catalog-hive	79.35%	🟢
catalog-jdbc-clickhouse	80.02%	🟢
catalog-jdbc-common	45.31%	🟢
catalog-jdbc-doris	80.28%	🟢
catalog-jdbc-hologres	54.03%	🟢
catalog-jdbc-mysql	79.23%	🟢
catalog-jdbc-oceanbase	78.38%	🟢
catalog-jdbc-postgresql	82.29%	🟢
catalog-jdbc-starrocks	78.51%	🟢
catalog-kafka	77.01%	🟢
catalog-lakehouse-generic	58.53%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.94%	🟢
catalog-lakehouse-paimon	79.29%	🟢
catalog-model	77.72%	🟢
cli	44.51%	🟢
client-java	77.91%	🟢
common	50.17%	🟢
core	82.51%	🟢
filesystem-hadoop3	76.97%	🟢
flink	0.0%	🔴
flink-common	47.15% `-1.35%`	🟢
flink-runtime	0.0%	🔴
gcp	14.12%	🔴
hadoop-common	10.39%	🔴
hive-metastore-common	53.9%	🟢
iceberg-common	57.41%	🟢
iceberg-rest-server	73.8%	🟢
idp-basic	86.07%	🟢
integration-test-common	0.0%	🔴
jobs	66.17%	🟢
lance-common	20.81%	🔴
lance-rest-server	60.54%	🟢
lineage	53.02%	🟢
optimizer	82.87%	🟢
optimizer-api	21.95%	🔴
server	85.73%	🟢
server-common	73.28%	🟢
spark	28.57%	🔴
spark-common	41.54% `-2.11%`	🟢
trino-connector	40.18% `+1.31%`	🟢

Files

Module	File	Coverage
catalog-common	AuthProperties.java	0.0%	🔴
flink-common	GravitinoCatalogStoreFactoryOptions.java	100.0%	🟢
	GravitinoCatalogManager.java	20.0%	🔴
spark-common	GravitinoDriverPlugin.java	15.15%	🔴
	GravitinoSparkConfig.java	0.0%	🔴
trino-connector	GravitinoAuthProvider.java	81.2%	🟢

roryqi · 2026-06-07T09:01:18Z

+      String gravitinoUri, Map<String, String> config) {
+    String username = config.get(GravitinoCatalogStoreFactoryOptions.BASIC_USERNAME);
+    String password = config.get(GravitinoCatalogStoreFactoryOptions.BASIC_PASSWORD);
+    if (Strings.isNullOrEmpty(username)) {


StringUtils.

Got resolved.

roryqi · 2026-06-07T09:01:26Z

+    String username = config.get(GravitinoCatalogStoreFactoryOptions.BASIC_USERNAME);
+    String password = config.get(GravitinoCatalogStoreFactoryOptions.BASIC_PASSWORD);
+    if (Strings.isNullOrEmpty(username)) {
+      throw new IllegalArgumentException(


Preconditions.

Got resolved.

roryqi · 2026-06-07T09:03:10Z

+      GravitinoAdminClient.AdminClientBuilder builder, Map<String, String> config) {
+    String username = config.get(BASIC_USERNAME_KEY);
+    String password = config.get(BASIC_PASSWORD_KEY);
+    if (StringUtils.isBlank(username)) {


Preconditions.

Got resolved.

Co-authored-by: Cursor <cursoragent@cursor.com>

roryqi

LGTM.

diqiu50 · 2026-06-08T03:28:42Z

+ * connector-side config parsing is covered by {@code TestGravitinoAuthProvider#testBuildBasicAuth}.
+ */
+public class TrinoBasicAuthIT extends BaseIT {
+


This test has nothing to do with Trino, right?

Thank you very much for your suggestion.I have restructured this method and it will conduct the basic authentication test.

diqiu50 · 2026-06-08T03:45:28Z

+    try (GravitinoAdminClient basicClient =
+        GravitinoAdminClient.builder(gravitinoUri).withBasicAuth(ADMIN, ADMIN_PASSWORD).build()) {
+      GravitinoMetalake loadedMetalake = basicClient.loadMetalake(METALAKE);
+      Assertions.assertEquals(METALAKE, loadedMetalake.name());


The integration test you added cannot verify whether Spark, Trino, and Flink can connect to the Gravitino server. It is more like a basic authentication test between the Gravitino client and the Gravitino server.

Thank you very much for your suggestion.I have restructured this method and it will conduct the basic authentication test.

What I mean is that simply verifying that SHOW CATALOGS does not throw an exception cannot validate your change. If this is the way you are testing it, it would be better to add an integration test to verify the basic authentication between the Gravitino client and the Gravitino server.

If this integration test is in place, you can add unit tests to ensure the connector configuration is processed correctly. and remove the integration tests for those connectors. Manual verification is also acceptable.

Thank you very much for your suggestion. I have followed the method you mentioned and deleted the unnecessary IT, and also added the IT for the basic client. Additionally, I have already set up Trino/Spark/Flink clusters locally and successfully implemented basic authentication(Tested the create/select/insert table operations).

Resolve conflict in spark-authentication-with-gravitino.md by keeping basic auth in the authType supported values table. Co-authored-by: Cursor <cursoragent@cursor.com>

diqiu50 · 2026-06-09T02:05:20Z

+
+  @Test
+  void testTrinoConnectorConnectsWithBasicAuth() {
+    Assertions.assertDoesNotThrow(() -> trinoQueryRunner.runQuery("SHOW CATALOGS"));


Your test only relies on SHOW CATALOGS, which is insufficient to validate your changes.

Thank you very much for your suggestion. I have followed the method you mentioned and deleted the unnecessary IT, and also added the IT for the basic client. Additionally, I have already set up Trino/Spark/Flink clusters locally and successfully implemented basic authentication(Tested the create/select/insert table operations).

…nt IT. Move end-to-end Basic authentication coverage to BasicAuthOperationsIT in client-java, and add connector UTs that verify Basic auth configuration parsing and validation without duplicating Spark/Flink/Trino integration tests. Co-authored-by: Cursor <cursoragent@cursor.com>

@afterall

Initialize the Basic auth client in @BeforeAll, add @afterall teardown, and rename the test method to testAuthenticationApi for consistency. Co-authored-by: Cursor <cursoragent@cursor.com>

diqiu50

LGTM

diqiu50 · 2026-06-09T07:22:18Z

Please update description of this PR

lasdf1234 · 2026-06-09T07:37:32Z

Please update description of this PR

Got Description has been updated.

…rt for Spark, Flink, and Trino connectors (#11457) (#11531) **Cherry-pick Information:** - Original commit: d7fe5f5 - Target branch: `branch-1.3` - Status: ✅ Clean cherry-pick (no conflicts) --------- Co-authored-by: MaSai <30949009+lasdf1234@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Qi Yu <yuqi@datastrato.com> Co-authored-by: yuqi <yuqi4733@apache.org>

lasdf1234 and others added 2 commits June 5, 2026 17:17

Merge branch 'main' of github.com:apache/gravitino into 11443-connect…

5e01d5d

…or-basic-auth Resolve documentation conflicts from the docs style sweep while keeping Basic authentication content for Spark, Flink, and Trino connectors. Co-authored-by: Cursor <cursoragent@cursor.com>

lasdf1234 closed this Jun 5, 2026

lasdf1234 added the branch-1.3 Automatically cherry-pick commit to branch-1.3 label Jun 5, 2026

lasdf1234 and others added 4 commits June 5, 2026 17:27

[MINOR] docs: Remove See Also section from Flink auth doc

3efefc9

Co-authored-by: Cursor <cursoragent@cursor.com>

[MINOR] docs: Remove See Also section from Spark auth doc

97543f1

Co-authored-by: Cursor <cursoragent@cursor.com>

[MINOR] refactor(flink): Simplify unsupported auth type error message

9d1b037

Co-authored-by: Cursor <cursoragent@cursor.com>

lasdf1234 reopened this Jun 5, 2026

lasdf1234 and others added 2 commits June 5, 2026 18:14

[MINOR] docs: Align connector authentication markdown tables

7522816

Co-authored-by: Cursor <cursoragent@cursor.com>

lasdf1234 requested review from diqiu50 and roryqi June 5, 2026 12:42

lasdf1234 changed the title ~~[#11443] feat(connector): Add Basic auth for Spark, Flink, and Trino~~ [#11443] feat(auth): Add Basic auth support for Spark, Flink, and Trino connectors Jun 5, 2026

roryqi reviewed Jun 7, 2026

View reviewed changes

[MINOR] refactor(connector): Use Preconditions for Basic auth validation

762c8b8

Co-authored-by: Cursor <cursoragent@cursor.com>

roryqi previously approved these changes Jun 8, 2026

View reviewed changes

roryqi assigned lasdf1234 Jun 8, 2026

diqiu50 reviewed Jun 8, 2026

View reviewed changes

Fix

7006b2d

lasdf1234 dismissed roryqi’s stale review via 7006b2d June 8, 2026 08:18

Merge branch 'main' into 11443-connector-basic-auth

4781637

Resolve conflict in spark-authentication-with-gravitino.md by keeping basic auth in the authType supported values table. Co-authored-by: Cursor <cursoragent@cursor.com>

lasdf1234 requested a review from diqiu50 June 8, 2026 08:29

diqiu50 reviewed Jun 9, 2026

View reviewed changes

lasdf1234 and others added 2 commits June 9, 2026 10:52

Align BasicAuthOperationsIT lifecycle with KerberosOperationsIT.

59da528

Initialize the Basic auth client in @BeforeAll, add @afterall teardown, and rename the test method to testAuthenticationApi for consistency. Co-authored-by: Cursor <cursoragent@cursor.com>

lasdf1234 requested a review from diqiu50 June 9, 2026 06:15

diqiu50 approved these changes Jun 9, 2026

View reviewed changes

jerryshao merged commit d7fe5f5 into apache:main Jun 9, 2026
33 checks passed

lasdf1234 deleted the 11443-connector-basic-auth branch June 10, 2026 00:26

Conversation

lasdf1234 commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes were proposed in this pull request?

Why are the changes needed?

Does this PR introduce any user-facing change?

How was this patch tested?

Uh oh!

github-actions Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

roryqi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

diqiu50 left a comment

Choose a reason for hiding this comment

Uh oh!

diqiu50 commented Jun 9, 2026

Uh oh!

lasdf1234 commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lasdf1234 commented Jun 5, 2026 •

edited

Loading

github-actions Bot commented Jun 5, 2026 •

edited

Loading