apache / apache/polaris

bootstrap command always creates a principal with name "root" | external IDP configuration with dynamic principals results in a chicken and egg problem

Open
#2,238 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
2.1k
Forks
522
Avg merge
1d 22h
Merged PRs (30d)
137

Description

### Describe the bug

I'm trying to configure polaris 1.0.0 to work with external Identity Provider following - https://github.com/apache/polaris/pull/1397

Looks like when bootstrapping with `java -jar runtime/admin/build/quarkus-app/quarkus-run.jar bootstrap -r POLARIS -c POLARIS,,blah` the is ignored and a hardcoded "root" principal is created in the `polaris_schema.entity`.
Which when decoding a JWT, the `` in the "sub" doesn't match since its a unique id and not "root"

So, it feels like, there's no way to configure a dynamic principal id as root in polaris with External IDP.

### To Reproduce

`config/application.properties` -
```.properties
polaris.bootstrap.credentials=POLARIS,1234,blah

# persistence
polaris.persistence.type=relational-jdbc
quarkus.datasource.db-kind=postgresql
quarkus.datasource.username=postgres
quarkus.datasource.password=
quarkus.datasource.jdbc.url=jdbc:postgresql://127.0.0.1:5432/postgres

# authn, authz
quarkus.oidc.tenant-enabled=true
quarkus.oidc.discovery-enabled=true
quarkus.oidc.auth-server-url=
polaris.authentication.type=external
polaris.oidc.principal-mapper.name-claim-path=sub

polaris.oidc.principal-roles-mapper.filter=^(admin-grp).*
polaris.oidc.principal-roles-mapper.mappings[0].regex=\\badmin-grp\\b
polaris.oidc.principal-roles-mapper.mappings[0].replacement=PRINCIPAL_ROLE:ALL
```

jwt -
```json
{
"iss": "",
"aud": "polaris",
"exp": 1754045079,
"iat": 1754016279,
"sub": "1234",
"groups": [
"admin-grp",
],
"email": "alice@work.com"
}
```

### Actual Behavior

error -
```
Failed to resolve principal from credentials=OidcPrincipalAuthInfo[getPrincipalId=null, getPrincipalName=1234, getPrincipalRoles=[PRINCIPAL_ROLE:ALL]]
```

### Expected Behavior

Ideally it should be able to resolve with name lookup, if bootstrap created a principal with name `` instead of "root"

### Additional context

_No response_

### System information

polaris tag - apache-polaris-1.0.0-incubating

Contributor guide

Open the contributing guide

Research direction

Start with the bootstrap command and the config/application.properties settings, then trace how the bootstrap credentials and the JWT sub value are stored and resolved against polaris_schema.entity. Reproduce with principal ID 1234 and verify that authentication resolves the external principal instead of reporting a missing root principal.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, postgresql
Domain
authentication, database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.