fix(auth): bind internal JWTs to principal secret generation by vigneshio · Pull Request #5053 · apache/polaris

vigneshio · 2026-07-13T18:29:58Z

Bind internal JWT access tokens to their issuing credential generation via a polaris-cv claim (no secret material in the token). Verification honors the current and secondary generations, matching the existing dual-secret rotation grace.

Single rotations leave active tokens valid; resets (and a second rotation) invalidate prior generations. Token exchange preserves the subject token's generation. Claim-less tokens still verify until expiry for upgrade compatibility, but exchange rejects them. Tokens for deleted principals are rejected because verification requires loadable secrets. Persistence failures while loading secrets during verify return service unavailable rather than an authentication failure. No schema migration is needed.

dimas-b

Thanks for your diligence, @vigneshio ! The general idea is very reasonable. Some implementation comments below.

dimas-b

partial review

flyrain

Thanks @vigneshio for the PR. I have replied in the private mailing list. I think it's valid to introduce an explicit invalidation operation, but I'm not convinced that we need to invalidate access tokens for principal credential rotating and resetting.

vigneshio · 2026-07-30T07:16:02Z

Thanks @vigneshio for the PR. I have replied in the private mailing list. I think it's valid to introduce an explicit invalidation operation, but I'm not convinced that we need to invalidate access tokens for principal credential rotating and resetting.

Thanks for the review @flyrain replied in the private thread as well.. PTAL.. The description is now updated to match the actual semantics!!.

dimas-b

LGTM overall 👍 Some more minor comments.

dimas-b

Thanks, @vigneshio !

Drop an unrelated CHANGELOG line. Map metastore load failures during token verify to service unavailable instead of NotAuthorized/invalid_client. Reject claim-less legacy tokens on exchange so they cannot be re-minted onto the current credentials generation; bearer verify until expiry is unchanged for upgrade compatibility.

Propagate ServiceUnavailableException from token verify in InternalAuthenticationMechanism so INTERNAL and MIXED auth return 503 instead of treating metastore failures as bad credentials or falling through to external auth. Add unit and HTTP-level coverage.

Shorten the polaris-cv CHANGELOG entry to user-facing behavior only, and use a finite await timeout in InternalAuthenticationMechanismTest.

…_grant, breaking-change note

flyingImer

The latest exchange-only rewrite looks sound; I don’t see a code blocker. I have two wording nits so the public contract and rolling-upgrade behavior match the implementation, plus one small stale-test cleanup. Once those are addressed, this looks ready to merge.

flyrain · 2026-09-04T21:48:01Z

Given we have 3 approvals on the PR, I'd propose to merge it once CI is happy.

vigneshio · 2026-09-04T22:48:30Z

Good points @flyingImer updated the wording/tests to match the exchange-only contract...

PTAL.. @dimas-b @flyrain before we merge.

The latest exchange-only rewrite looks sound; I don’t see a code blocker. I have two wording nits so the public contract and rolling-upgrade behavior match the implementation, plus one small stale-test cleanup. Once those are addressed, this looks ready to merge.

flyrain · 2026-09-04T23:19:08Z

Thanks for working on it, @vigneshio! Appreciated your patience and persistence! Thanks everyone for the review.

github-project-automation Bot added this to Basic Kanban Board Jul 13, 2026

github-project-automation Bot moved this to PRs In Progress in Basic Kanban Board Jul 13, 2026

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 5925d16 to 1a98a23 Compare July 16, 2026 13:35

dimas-b reviewed Jul 16, 2026

View reviewed changes

dimas-b requested review from adutra and snazy July 16, 2026 22:47

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 1a98a23 to 083f99e Compare July 17, 2026 08:02

dimas-b reviewed Jul 17, 2026

View reviewed changes

Comment thread polaris-core/src/main/java/org/apache/polaris/core/entity/PolarisPrincipalSecrets.java Outdated

dimas-b reviewed Jul 20, 2026

View reviewed changes

Comment thread runtime/service/src/main/java/org/apache/polaris/service/auth/internal/broker/JWTBroker.java Outdated

Comment thread runtime/service/src/main/java/org/apache/polaris/service/auth/internal/broker/JWTBroker.java Outdated

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from bba3287 to a66743e Compare July 20, 2026 20:56

dimas-b reviewed Jul 23, 2026

View reviewed changes

Comment thread runtime/service/src/main/java/org/apache/polaris/service/auth/internal/broker/JWTBroker.java Outdated

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 0f31cd0 to e082112 Compare July 24, 2026 15:01

dimas-b reviewed Jul 24, 2026

View reviewed changes

Comment thread runtime/service/src/main/java/org/apache/polaris/service/auth/internal/broker/JWTBroker.java Outdated

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 6158068 to 5377243 Compare July 26, 2026 11:43

jbonofre self-requested a review July 27, 2026 16:56

dimas-b reviewed Jul 27, 2026

View reviewed changes

adutra reviewed Jul 27, 2026

View reviewed changes

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 5377243 to de40af7 Compare July 28, 2026 10:08

adutra previously approved these changes Jul 28, 2026

View reviewed changes

Comment thread ...st/java/org/apache/polaris/service/auth/internal/broker/JWTBrokerCredentialsBindingTest.java Outdated

github-project-automation Bot moved this from PRs In Progress to Ready to merge in Basic Kanban Board Jul 28, 2026

flyrain requested a review from adnanhemani July 28, 2026 22:15

flyrain reviewed Jul 28, 2026

View reviewed changes

vigneshio dismissed adutra’s stale review via 29c2bf5 July 30, 2026 11:50

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 29c2bf5 to 000eb97 Compare August 8, 2026 07:47

dimas-b reviewed Aug 10, 2026

View reviewed changes

Comment thread polaris-core/src/main/java/org/apache/polaris/core/entity/PolarisPrincipalSecrets.java Outdated

Comment thread polaris-core/src/main/java/org/apache/polaris/core/entity/PolarisPrincipalSecrets.java Outdated

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 000eb97 to a48b81e Compare August 12, 2026 17:32

dimas-b previously approved these changes Aug 12, 2026

View reviewed changes

vigneshio requested review from adutra and flyrain August 19, 2026 10:59

vigneshio added 11 commits September 5, 2026 00:29

test(auth): chain exchange-generation assertions per review

7b4d2ad

chore(auth): tighten changelog and avoid indefinite test awaits

2bad116

Shorten the polaris-cv CHANGELOG entry to user-facing behavior only, and use a finite await timeout in InternalAuthenticationMechanismTest.

fix(auth): align token-verify 503 with shared auth contract

7cce8c7

refactor(auth): narrow jwt pr scope

8b697b8

fix(auth): address review round - validateCredentialsVersion, invalid…

2a26635

…_grant, breaking-change note

fix(auth): map malformed-claim tokens to 401 instead of NPE on exchange

45df37d

docs(changelog): note per-request secrets read during token verify

707412c

fix(auth): enforce polaris-cv on token exchange only

abe1a2d

docs(auth): align polaris-cv docs with exchange-only enforcement

eef09e1

vigneshio dismissed flyrain’s stale review via eef09e1 September 4, 2026 19:02

vigneshio force-pushed the fix/jwt-bind-credentials-epoch branch from 7015fbc to eef09e1 Compare September 4, 2026 19:02

vigneshio requested review from dimas-b and flyrain September 4, 2026 19:05

flyrain previously approved these changes Sep 4, 2026

View reviewed changes

flyingImer approved these changes Sep 4, 2026

View reviewed changes

Comment thread polaris-core/src/main/java/org/apache/polaris/core/entity/PolarisPrincipalSecrets.java Outdated

Comment thread CHANGELOG.md Outdated

Comment thread runtime/service/src/test/java/org/apache/polaris/service/ratelimiter/RateLimiterFilterTest.java Outdated

flyrain closed this Sep 4, 2026

github-project-automation Bot moved this from Ready to merge to Done in Basic Kanban Board Sep 4, 2026

flyrain reopened this Sep 4, 2026

github-project-automation Bot moved this from Done to PRs In Progress in Basic Kanban Board Sep 4, 2026

docs(auth): clarify exchange-only polaris-cv wording

d3e4b79

vigneshio dismissed flyrain’s stale review via d3e4b79 September 4, 2026 22:44

flyrain approved these changes Sep 4, 2026

View reviewed changes

github-project-automation Bot moved this from PRs In Progress to Ready to merge in Basic Kanban Board Sep 4, 2026

flyrain merged commit 8775ef4 into apache:main Sep 4, 2026
24 checks passed

github-project-automation Bot moved this from Ready to merge to Done in Basic Kanban Board Sep 4, 2026

Uh oh!

Conversation

vigneshio commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flyrain left a comment

Choose a reason for hiding this comment

Uh oh!

vigneshio commented Jul 30, 2026

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

flyingImer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flyrain commented Sep 4, 2026

Uh oh!

vigneshio commented Sep 4, 2026

Uh oh!

Uh oh!

flyrain commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vigneshio commented Jul 13, 2026 •

edited

Loading