Flink authentication
The Flink connector authenticates to the Gravitino server with the setting
table.catalog-store.gravitino.gravitino.client.auth.type, which accepts basic or oauth2. The
Datastrato Enterprise server accepts both. Leaving the setting unset makes the connector fall back to
Flink's own security settings, or to simple, which sends a user name with no password and which the
server does not accept.
Quick start
The example signs the connector in to a server that uses OAuth, with a client registered at the
identity provider the server trusts. The connector requests a token with the client credentials
grant, sending it to serverUri joined with tokenPath.
-
Add the OAuth settings to the Flink configuration, in place of the Basic settings from the Flink connector Quick start.
flink-conf.yamltable.catalog-store.kind: gravitino
table.catalog-store.gravitino.gravitino.uri: https://{gravitino_host}
table.catalog-store.gravitino.gravitino.metalake: {metalake}
table.catalog-store.gravitino.gravitino.client.auth.type: oauth2
table.catalog-store.gravitino.gravitino.client.oauth2.serverUri: https://{idp_host}
table.catalog-store.gravitino.gravitino.client.oauth2.tokenPath: {token_path}
table.catalog-store.gravitino.gravitino.client.oauth2.credential: {client_id}:{client_secret}
table.catalog-store.gravitino.gravitino.client.oauth2.scope: {scope} -
Restart Flink, open the SQL client, and list the catalogs. The metalake's catalogs appear when the sign-in works.
Confirm the connector is signed inSHOW CATALOGS;
Basic mode
Basic mode sends a user name and password from the server's local user store. The server must have Basic authentication enabled; see How to authenticate. The Flink connector Quick start shows a complete configuration.
| Property | Type | Default | Description | Required |
|---|---|---|---|---|
table.catalog-store.gravitino.gravitino.client.auth.type | string | (none) | basic | Yes |
table.catalog-store.gravitino.gravitino.client.basic.username | string | (none) | User name in the local user store | Yes, for Basic |
table.catalog-store.gravitino.gravitino.client.basic.password | string | (none) | Password for that user | Yes, for Basic |
OAuth mode
OAuth mode requests an access token from the identity provider with the client credentials grant. The Quick start shows a complete configuration.
| Property | Type | Default | Description | Required |
|---|---|---|---|---|
table.catalog-store.gravitino.gravitino.client.auth.type | string | (none) | oauth2 | Yes |
table.catalog-store.gravitino.gravitino.client.oauth2.serverUri | string | (none) | Base address of the identity provider | Yes, for OAuth |
table.catalog-store.gravitino.gravitino.client.oauth2.tokenPath | string | (none) | Token endpoint path, joined to serverUri | Yes, for OAuth |
table.catalog-store.gravitino.gravitino.client.oauth2.credential | string | (none) | Client credentials as {client_id}:{client_secret} | Yes, for OAuth |
table.catalog-store.gravitino.gravitino.client.oauth2.scope | string | (none) | Scope to request with the token | Yes, for OAuth |