bootstrap command always creates a principal with name "root" | external IDP configuration with dynamic principals results in a chicken and egg problem
- Dominant language
- Java
- Stars
- 2.1k
- Forks
- 522
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 137
Description
### Describe the bug
I'm trying to configure polaris 1.0.0 to work with external Identity Provider following - https://github.com/apache/polaris/pull/1397
Looks like when bootstrapping with `java -jar runtime/admin/build/quarkus-app/quarkus-run.jar bootstrap -r POLARIS -c POLARIS,,blah` the is ignored and a hardcoded "root" principal is created in the `polaris_schema.entity`.
Which when decoding a JWT, the `` in the "sub" doesn't match since its a unique id and not "root"
So, it feels like, there's no way to configure a dynamic principal id as root in polaris with External IDP.
### To Reproduce
`config/application.properties` -
```.properties
polaris.bootstrap.credentials=POLARIS,1234,blah
# persistence
polaris.persistence.type=relational-jdbc
quarkus.datasource.db-kind=postgresql
quarkus.datasource.username=postgres
quarkus.datasource.password=
quarkus.datasource.jdbc.url=jdbc:postgresql://127.0.0.1:5432/postgres
# authn, authz
quarkus.oidc.tenant-enabled=true
quarkus.oidc.discovery-enabled=true
quarkus.oidc.auth-server-url=
polaris.authentication.type=external
polaris.oidc.principal-mapper.name-claim-path=sub
polaris.oidc.principal-roles-mapper.filter=^(admin-grp).*
polaris.oidc.principal-roles-mapper.mappings[0].regex=\\badmin-grp\\b
polaris.oidc.principal-roles-mapper.mappings[0].replacement=PRINCIPAL_ROLE:ALL
```
jwt -
```json
{
"iss": "",
"aud": "polaris",
"exp": 1754045079,
"iat": 1754016279,
"sub": "1234",
"groups": [
"admin-grp",
],
"email": "alice@work.com"
}
```
### Actual Behavior
error -
```
Failed to resolve principal from credentials=OidcPrincipalAuthInfo[getPrincipalId=null, getPrincipalName=1234, getPrincipalRoles=[PRINCIPAL_ROLE:ALL]]
```
### Expected Behavior
Ideally it should be able to resolve with name lookup, if bootstrap created a principal with name `` instead of "root"
### Additional context
_No response_
### System information
polaris tag - apache-polaris-1.0.0-incubating
Contributor guide
Research direction
Start with the bootstrap command and the config/application.properties settings, then trace how the bootstrap credentials and the JWT sub value are stored and resolved against polaris_schema.entity. Reproduce with principal ID 1234 and verify that authentication resolves the external principal instead of reporting a missing root principal.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, postgresql
- Domain
- authentication, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100