Flink authentication

Overview

Flink connector supports simple, basic, oauth2, and kerberos authentication when accessing the Gravitino server.

Property	Type	Default Value	Description	Required
table.catalog-store.gravitino.gravitino.client.auth.type	string	(none)	When explicitly set, only oauth2 and basic are supported.	No

Simple mode

In simple mode, the username originates from Flink. The resolution order is:

1. HADOOP_USER_NAME environment variable
2. The logged-in OS user

Basic mode

In Basic mode, the Flink connector authenticates to the Gravitino server using HTTP Basic credentials against the local user store. The Gravitino server must have Basic authentication enabled. See How to authenticate for server-side setup.

Property	Type	Default Value	Description	Required
table.catalog-store.gravitino.gravitino.client.auth.type	string	(none)	Set to basic to enable Basic authentication.	Yes, for Basic mode
table.catalog-store.gravitino.gravitino.client.basic.username	string	(none)	Username in the local user store.	Yes, for Basic mode
table.catalog-store.gravitino.gravitino.client.basic.password	string	(none)	Password for that user.	Yes, for Basic mode

Basic configuration example

flink-conf.yaml

table.catalog-store.kind: gravitino
table.catalog-store.gravitino.gravitino.uri: http://localhost:8090
table.catalog-store.gravitino.gravitino.metalake: my_metalake
table.catalog-store.gravitino.gravitino.client.auth.type: basic
table.catalog-store.gravitino.gravitino.client.basic.username: admin
table.catalog-store.gravitino.gravitino.client.basic.password: YourSecureGravitinoPassword

OAuth mode

In OAuth mode, configure the following settings to fetch an OAuth token to access the Gravitino server:

Property	Type	Default Value	Description	Required
table.catalog-store.gravitino.gravitino.client.oauth2.serverUri	string	(none)	The OAuth server URI.	Yes, for OAuth mode
table.catalog-store.gravitino.gravitino.client.oauth2.tokenPath	string	(none)	The token endpoint path on the OAuth server.	Yes, for OAuth mode
table.catalog-store.gravitino.gravitino.client.oauth2.credential	string	(none)	The credential used to request the OAuth token.	Yes, for OAuth mode
table.catalog-store.gravitino.gravitino.client.oauth2.scope	string	(none)	The scope used to request the OAuth token.	Yes, for OAuth mode

OAuth configuration example

flink-conf.yaml

table.catalog-store.kind: gravitino
table.catalog-store.gravitino.gravitino.uri: http://localhost:8090
table.catalog-store.gravitino.gravitino.metalake: my_metalake
table.catalog-store.gravitino.gravitino.client.auth.type: oauth2
table.catalog-store.gravitino.gravitino.client.oauth2.serverUri: https://{oauth_host}
table.catalog-store.gravitino.gravitino.client.oauth2.tokenPath: /oauth/token
table.catalog-store.gravitino.gravitino.client.oauth2.credential: client-id:client-secret
table.catalog-store.gravitino.gravitino.client.oauth2.scope: {scope}

Kerberos mode

In Kerberos mode, use Flink security configurations to obtain a Kerberos ticket for accessing the Gravitino server. Configure security.kerberos.login.principal and security.kerberos.login.keytab for the Kerberos principal and keytab.

The Gravitino server principal follows the pattern HTTP/$host@$realm; ensure $host matches the host specified in the Gravitino server URI. Ensure krb5.conf is available to Flink, for example via -Djava.security.krb5.conf=/path/to/krb5.conf in Flink JVM options.