search

apache / polaris

The interoperable, open source catalog for Apache Iceberg
http://polaris.io/
Apache License 2.0
1.03k stars 104 forks source link

Remove implementation of `/v1/oauth/tokens` endpoint #12

Open jbonofre opened 1 month ago

jbonofre commented 1 month ago

The oauth/tokens endpoint is already deprecated for removal due to security concerns. The path forward is described in this doc.

flyrain commented 1 month ago

We don't recommend anyone to use it in a prod env, but it's a nice feature to allow people to try Polaris out easily, otherwise they have to hook a third-party token service before doing anything else. What we can do here is to remove it while providing an private endpoint with the same functionality for test purpose. In that case, the real prod user can hook their token service, while we still use the private endpoint for testing.

dimas-b commented 1 month ago

It is pretty easy to setup Keycloak, for example, as an IdP for "getting started" environments.

Nessie has an example here: https://github.com/projectnessie/nessie/tree/main/docker/authn-keycloak

dimas-b commented 1 month ago

providing an private endpoint with the same functionality for test purpose

I'm not sure it is as easy as it sounds. A proper OAuth2 implementation is not a small effort. On the other hand, a test impl. that has gaps wrt to the OAuth2 RFC can lead to bugs in production code because it would be tested against a non-compliant OAuth2 server.

I believe it is preferable to reuse existing OSS implementations that provide OAuth2.

dimas-b commented 1 month ago

A tangential point: if Quarkus were used as the server platform, it provides easy ways to test authN/Z in CI without requiring a full OAuth2/OIDC implementation.

flyrain commented 1 month ago

Agreed, it's great to reuse an existing OAuth2 implementation. We will need to see how integration works to choose between them.