feat(rest): request vended storage credentials - #12
Closed
smaheshwar-pltr wants to merge 1 commit into
Closed
smaheshwar-pltr wants to merge 1 commit into
smaheshwar-pltr wants to merge 1 commit into
Conversation
smaheshwar-pltr
commented
Jun 27, 2026
| /// request, asking the server to delegate storage access for loaded tables | ||
| /// (use "vended-credentials" to request vended storage credentials). Unset by | ||
| /// default; an explicit "header." override of the same header takes precedence. | ||
| inline static Entry<std::string> kAccessDelegation{"access-delegation", ""}; |
Owner
Author
There was a problem hiding this comment.
I'm confused by this. I'd have thought this PR would just involved setting vended-credentials everywhere. Especially because, like PyIceberg and iceberg-rust, that's the only delegation mode iceberg-cpp even supports. What's the reason for this stuff I'm seeing here?
smaheshwar-pltr
force-pushed
the
rest-access-delegation-header
branch
2 times, most recently
from
June 27, 2026 23:20
d100f3b to
0f83157
Compare
smaheshwar-pltr
commented
Jun 27, 2026
| return StringUtils::ToUpper(header.first) == canonical; | ||
| }); | ||
| if (!set_by_caller) { | ||
| headers.emplace(kHeaderAccessDelegation, kAccessDelegationVendedCredentials); |
Owner
Author
There was a problem hiding this comment.
Sending this by default mirrors PyIceberg, which sets the access-delegation header on the session for every request and only ever uses vended-credentials:
- https://github.com/apache/iceberg-python/blob/01a86f987d1924ca3246a2b985b78890ec0c0fbd/pyiceberg/catalog/rest/__init__.py#L881
- https://github.com/apache/iceberg-python/blob/01a86f987d1924ca3246a2b985b78890ec0c0fbd/pyiceberg/catalog/rest/__init__.py#L235
The Java REST client does not send this header; engines like Trino set it via a header.* catalog property.
smaheshwar-pltr
force-pushed
the
rest-access-delegation-header
branch
from
September 6, 2026 22:05
ec8741b to
3e3fed8
Compare
smaheshwar-pltr
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Send
X-Iceberg-Access-Delegation: vended-credentialsby default on REST requests. An explicitly configured access-delegation header still wins, including when its name uses different casing.Why
A REST server only vends storage credentials when the client requests delegation. iceberg-cpp already parses and applies those credentials, so the default request completes that flow.
Validation
Added coverage for the default header, prefix stripping, and case-insensitive overrides. The full GitHub Actions matrix passed.
AI assistance: Codex was used to rebase and review the existing change against current main. I reviewed the resulting diff and validation.