Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Polaris external identity provider (mixed mode) and per-user data-access path

Open
  • Is something wrong?
#367 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
java, python
Domain
authentication, authorization, backend, databases

Research direction

Start with ADR 0015 and the referenced #179 ADR, then follow the five-step plan and its verification questions. Trace the bootstrap Job, olf, Polaris authentication, and Trino's iceberg.rest-catalog.session=USER path to identify the relevant entry points. Done means the mixed-mode migration and verification are complete, the per-user enforcement point is decided for both provider paths, and the dormant om principal and om_* fields are removed.

Written by the indexing model from the issue text.

Description

Follow-up deferred from #26 and #179 (v0.5-alpha). Scope, sequenced before the v1.0 governance issues #54–#57 that assume identity reaches the data.

Background: ADR 0015 (PR #366) evaluates Polaris 1.4.0 external-authentication support and defers the migration. It does not replace Polaris' own principals; the issuer would replace authentication only, tokens must map to principals that already exist in the Polaris metastore, and external mode disables the token endpoint that the bootstrap Job and olf use, so mixed mode comes first.

Scope

  • Execute the 5-step plan in ADR 0015 (mixed mode first; existing callers must keep working).
  • Verify the ADR's "to verify" items: Polaris JVM trust of the local CA for the issuer URL; which claim names a Keycloak service-account principal; whether Floe accepts a non-Polaris token endpoint; Trino token refresh against 5-minute tokens; what Polaris receives under iceberg.rest-catalog.session=USER; whether SeaweedFS can issue vended credentials.
  • Per-user data-access path (#179 ADR): decide where table-level policy is enforced for Polaris vs Glue + Lake Formation (different mechanisms); the shared enforcement point across providers is Trino.
  • Remove the dormant om Polaris principal and its om_* contract fields (nothing reads its Secret; OpenMetadata crawls through Trino).

Out of scope

Implementing impersonation or any table/row/column policy in v0.5-alpha.

Dominant language
Python
Stars
26
Forks
6
Avg merge
12h 10m
Merged PRs (30d)
175

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenLakeForge/openlakeforge

All issues in OpenLakeForge/openlakeforge

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.