Package org.apache.polaris.service.catalog

Class DefaultAccessDelegationModeResolver

java.lang.Object

org.apache.polaris.service.catalog.DefaultAccessDelegationModeResolver

All Implemented Interfaces:

AccessDelegationModeResolver

@ApplicationScoped
public class DefaultAccessDelegationModeResolver
extends Object
implements AccessDelegationModeResolver

Default implementation of AccessDelegationModeResolver that resolves the optimal access delegation mode based on catalog capabilities and configuration.

The resolution logic:

1. If no delegation mode is requested, returns empty.
2. If exactly one delegation mode is requested:
   • If AccessDelegationMode.VENDED_CREDENTIALS is requested on an external catalog where credential vending is disabled (via FeatureConfiguration.ALLOW_EXTERNAL_CATALOG_CREDENTIAL_VENDING or FeatureConfiguration.ALLOW_FEDERATED_CATALOGS_CREDENTIAL_VENDING), throws IllegalArgumentException.
   • Otherwise returns that mode as-is.
3. If both AccessDelegationMode.VENDED_CREDENTIALS and AccessDelegationMode.REMOTE_SIGNING are requested, picks the best viable mode:
   • If the catalog is external and FeatureConfiguration.ALLOW_EXTERNAL_CATALOG_CREDENTIAL_VENDING is disabled, returns AccessDelegationMode.REMOTE_SIGNING (graceful degradation).
   • If the catalog is external/federated and FeatureConfiguration.ALLOW_FEDERATED_CATALOGS_CREDENTIAL_VENDING is disabled, returns AccessDelegationMode.REMOTE_SIGNING.
   • If credential subscoping is skipped, returns AccessDelegationMode.REMOTE_SIGNING.
   • If STS is unavailable for the catalog's AWS storage, returns AccessDelegationMode.REMOTE_SIGNING.
   • Otherwise returns AccessDelegationMode.VENDED_CREDENTIALS.

Constructor Summary

Constructors

Constructor	Description
DefaultAccessDelegationModeResolver(org.apache.polaris.core.config.RealmConfig realmConfig)

Method Summary

Modifier and Type	Method	Description
@NonNull Optional<AccessDelegationMode>	resolve(@NonNull EnumSet<AccessDelegationMode> requestedModes, @Nullable org.apache.polaris.core.entity.CatalogEntity catalogEntity)	Resolves the optimal access delegation mode based on the requested modes and catalog capabilities.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DefaultAccessDelegationModeResolver

@Inject
public DefaultAccessDelegationModeResolver(org.apache.polaris.core.config.RealmConfig realmConfig)

Method Details

resolve

public @NonNull Optional<AccessDelegationMode> resolve(@NonNull EnumSet<AccessDelegationMode> requestedModes,
 @Nullable org.apache.polaris.core.entity.CatalogEntity catalogEntity)

Description copied from interface: AccessDelegationModeResolver

Resolves the optimal access delegation mode based on the requested modes and catalog capabilities.

Specified by:

resolve in interface AccessDelegationModeResolver

Parameters:

requestedModes - The set of delegation modes requested by the client

catalogEntity - The catalog entity, used to determine storage configuration and capabilities

Returns:

The resolved access delegation mode, or empty if no suitable mode is available.