Skip to content

feat(java/driver/flight-sql): add OAuth2 support#4290

Open
lxyzxx wants to merge 1 commit intoapache:mainfrom
lxyzxx:java-OAuth2
Open

feat(java/driver/flight-sql): add OAuth2 support#4290
lxyzxx wants to merge 1 commit intoapache:mainfrom
lxyzxx:java-OAuth2

Conversation

@lxyzxx
Copy link
Copy Markdown
Contributor

@lxyzxx lxyzxx commented May 2, 2026

This change follows the earlier discussion in #4272.

Now that Arrow Java 19.0.0 has been merged, Java ADBC Flight SQL can reuse the OAuth2 support already implemented in Arrow Java. This commit wires that existing Arrow Java OAuth2 implementation into the Java ADBC Flight SQL driver, instead of introducing a separate OAuth implementation on the ADBC side.

What changed

  • add OAuth2 support for Java ADBC Flight SQL
  • support client_credentials
  • support token_exchange
  • align exposed OAuth parameter semantics with Arrow Java
  • preserve driver-thrown AdbcException status codes during connection setup
  • close FlightClient on failed authentication / handshake paths
  • add regression coverage for OAuth configuration validation
  • add HTTPS token endpoint coverage using JVM trustStore semantics

Usage notes

For client_credentials, configure:

  • adbc.flight.sql.oauth.flow
  • adbc.flight.sql.oauth.token_uri
  • adbc.flight.sql.oauth.client_id
  • adbc.flight.sql.oauth.client_secret

For token_exchange, use the corresponding adbc.flight.sql.oauth.exchange.* properties.

OAuth token endpoint HTTPS validation follows the Arrow Java / JVM SSL behavior and uses the JVM SSL configuration, such as:

  • javax.net.ssl.trustStore
  • javax.net.ssl.trustStorePassword
  • javax.net.ssl.trustStoreType

Flight server TLS continues to use the existing ADBC Flight SQL TLS connection properties.

Token refresh / re-acquisition is delegated to the reused Arrow Java OAuth provider and happens on demand when a valid token is needed for a request.

Validation

  • added / updated OAuth regression tests
  • manually verified client_credentials against a local Keycloak setup
  • verified token acquisition and successful Flight SQL connection
  • verified token re-acquisition after expiry on subsequent requests

@lxyzxx lxyzxx requested a review from lidavidm as a code owner May 2, 2026 06:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant