feat(auth): implement SigV4 authentication for REST catalog by plusplusjiajia · Pull Request #616 · apache/iceberg-cpp

plusplusjiajia · 2026-04-11T08:47:05Z

Implement AWS SigV4 authentication for the REST catalog client, following Java's RESTSigV4AuthManager and RESTSigV4AuthSession.

Extend AuthSession::Authenticate() with HTTPRequestContext (method, url, body) for SigV4 request signing
Add SigV4AuthSession: delegate-first auth → relocate conflicting Authorization header → sign with AWS SDK
Add SigV4AuthManager: wraps delegate AuthManager (default OAuth2), resolves credentials from properties or default chain
Body hash matches Java's SignerChecksumParams output: empty body → hex EMPTY_BODY_SHA256; non-empty body → Base64(SHA256(body))

evindj · 2026-04-14T02:01:48Z

src/iceberg/catalog/rest/auth/auth_managers.cc

+  ICEBERG_PRECHECK(delegate_type != AuthProperties::kAuthTypeSigV4,
+                   "Cannot delegate a SigV4 auth manager to another SigV4 auth manager");


add delegate_type in error message?

add delegate_type in error message?

Good idea, done.

evindj · 2026-04-14T02:22:30Z

.github/workflows/cpp-linter.yml

      - name: Install dependencies
        shell: bash
-        run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev
+        run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev ninja-build


n00b question why is ninja-build required here?

Good question — I added a build step in this PR so the linter can see the SigV4 code (needs compile_commands.json from a real build). I used cmake -G Ninja for speed and to be consistent with the other CI workflows, and Ninja is not preinstalled on ubuntu-24.04, hence the extra ninja-build package. Happy to switch to Make if you'd prefer.

evindj · 2026-04-14T02:27:31Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+    if (session_token_it != properties.end() && !session_token_it->second.empty()) {
+      Aws::Auth::AWSCredentials credentials(access_key_it->second.c_str(),
+                                            secret_key_it->second.c_str(),
+                                            session_token_it->second.c_str());
+      return std::make_shared<Aws::Auth::SimpleAWSCredentialsProvider>(credentials);
+    }
+    Aws::Auth::AWSCredentials credentials(access_key_it->second.c_str(),
+                                          secret_key_it->second.c_str());
+    return std::make_shared<Aws::Auth::SimpleAWSCredentialsProvider>(credentials);


Nit: could do only one return if Credentials are created in the conditional statement.

Nit: could do only one return if Credentials are created in the conditional statement.

Nice catch, done.

evindj · 2026-04-14T02:34:46Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+  auto it = properties.find(AuthProperties::kSigV4SigningName);
+  if (it != properties.end() && !it->second.empty()) {
+    return it->second;
+  }


if(properties.count(AuthProperties::kSigV4SigningName) > 0) { // do work }

might be a little less verbose than

auto it = properties.find(AuthProperties::kSigV4SigningName); if (it != properties.end() && !it->second.empty()) { return it->second; }

Thanks for the suggestion! I chose to keep the !it->second.empty() check on purpose — the intent is for an explicitly-empty value (e.g., a env var set to "") to also fall through to the legacy key / default.

evindj · 2026-04-14T02:47:39Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+    const TableIdentifier& table,
+    const std::unordered_map<std::string, std::string>& properties,
+    std::shared_ptr<AuthSession> parent) {
+  auto* sigv4_parent = dynamic_cast<SigV4AuthSession*>(parent.get());


use checked_pointer_cast instead

use checked_pointer_cast instead

Done here as well.

evindj · 2026-04-14T02:48:16Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+Result<std::shared_ptr<AuthSession>> SigV4AuthManager::ContextualSession(
+    const std::unordered_map<std::string, std::string>& context,
+    std::shared_ptr<AuthSession> parent) {
+  auto* sigv4_parent = dynamic_cast<SigV4AuthSession*>(parent.get());


use checked_pointer_cast

use checked_pointer_cast

Thanks, that's much better! Done.

evindj · 2026-04-14T02:51:39Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.h

+  std::string signing_region_;
+  std::string signing_name_;
+  std::shared_ptr<Aws::Auth::AWSCredentialsProvider> credentials_provider_;
+  /// Shared signer instance, matching Java's single Aws4Signer per manager.


I find this comment a bit confusing especially given that signer_ is a unique pointer that will be destroyed when SigV4AuthSession is destructed

You're right, sorry about the confusion — the "shared signer" wording was misleading since signer_ is owned per-session via unique_ptr. I've removed the comment.

evindj · 2026-04-14T02:54:50Z

src/iceberg/test/auth_manager_test.cc


  std::unordered_map<std::string, std::string> headers;
-  ASSERT_THAT(session_result.value()->Authenticate(headers), IsOk());
+  ASSERT_THAT(session_result.value()->Authenticate(headers, {}), IsOk());


it feels like Authenticate coudl accept a default value for the second parameter

Good point, thanks! Done

lishuxu · 2026-04-14T14:12:42Z

src/iceberg/catalog/rest/auth/auth_session.h

  ///         - IOError: Network or connection errors when reaching auth server
  ///         - RestError: HTTP errors from authentication service
-  virtual Status Authenticate(std::unordered_map<std::string, std::string>& headers) = 0;
+  virtual Status Authenticate(std::unordered_map<std::string, std::string>& headers,


The current design splits the request context into two separate parameters (headers as in-out + HTTPRequestContext as a separate struct).
The Java implementation uses a cleaner "request-in, request-out" pattern where authenticate() receives the full HTTPRequest and returns a new immutable request with auth headers, I'd suggest aligning with Java by introducing an HTTPRequest type that encapsulates method, url, headers, and body together, and changing the signature to:

virtual Result Authenticate(const HTTPRequest& request) = 0;

I'm open for this

Thanks @lishuxu ! Agreed — aligning with Java's request-in/request-out pattern is the right call. I'll address this in the current PR: introducing an HTTPRequest type (encapsulating method, url, headers, body), changing the signature to Result Authenticate(const HTTPRequest& request). Will push an update shortly — PTAL when it's ready.

lishuxu · 2026-04-14T14:35:38Z

src/iceberg/catalog/rest/auth/auth_properties.h

+  // ---- SigV4 AWS credential entries ----
+
+  /// AWS region for SigV4 signing.
+  inline static const std::string kSigV4SigningRegion = "rest.signing-region";


We can remove the legacy key kSigV4Region/kSigV4Service

lishuxu · 2026-04-14T14:38:49Z

src/iceberg/catalog/rest/auth/auth_properties.h

+  // ---- SigV4 AWS credential entries ----
+
+  /// AWS region for SigV4 signing.


The names are self-explanatory. I think we can remove them to keep the code concise.

lishuxu · 2026-04-14T14:40:50Z

src/iceberg/catalog/rest/auth/auth_properties.h

  inline static const std::string kSigV4DelegateAuthType =
      "rest.auth.sigv4.delegate-auth-type";

+  // ---- SigV4 AWS credential entries ----


Nit: the // ---- SigV4 AWS credential entries ---- section header is redundant given the // ---- SigV4 entries ---- block above already covers SigV4 config. Merge them into a single section.

lishuxu · 2026-04-14T14:49:32Z

src/iceberg/catalog/rest/auth/auth_managers.cc

 }

+#ifdef ICEBERG_BUILD_SIGV4
+Result<std::unique_ptr<AuthManager>> MakeSigV4AuthManager(


MakeSigV4AuthManager is implemented directly in auth_managers.cc, while all other factory functions (MakeNoopAuthManager, MakeBasicAuthManager, MakeOAuth2Manager) are defined in their own translation units and only declared in auth_manager_internal.h. Suggest moving the implementation to sigv4_auth_manager.cc for consistency.

Good catch! Done.

lishuxu · 2026-04-14T15:01:22Z

src/iceberg/catalog/rest/auth/auth_managers.cc


 #include "iceberg/catalog/rest/auth/auth_manager_internal.h"
+#ifdef ICEBERG_BUILD_SIGV4
+#  include "iceberg/catalog/rest/auth/sigv4_auth_manager.h"


Nit: auth_properties.h should come before the #ifdef ICEBERG_BUILD_SIGV4 block to maintain alphabetical include order.

Thanks for catching it!

plusplusjiajia force-pushed the sigv4 branch 5 times, most recently from bfc98f7 to 9ddbdbd Compare April 11, 2026 09:35

feat(auth): implement SigV4 authentication for REST catalog

eaa433f

plusplusjiajia force-pushed the sigv4 branch 3 times, most recently from 915c87b to d1c0732 Compare April 11, 2026 11:00

fix(ci): enable SigV4 build in cpp-linter workflow

4326282

plusplusjiajia force-pushed the sigv4 branch from d1c0732 to 4326282 Compare April 11, 2026 11:01

evindj reviewed Apr 14, 2026

View reviewed changes

plusplusjiajia added 3 commits April 14, 2026 11:13

address review feedback

6e12fbd

add single-arg Authenticate() overload

eb74231

sigv4 x-amz-content-sha256 must be Base64 in canonical headers

6a9cd32

lishuxu reviewed Apr 14, 2026

View reviewed changes

adopt request-in/request-out Authenticate interface

abb2cf6

lishuxu reviewed Apr 14, 2026

View reviewed changes

plusplusjiajia added 2 commits April 14, 2026 23:02

move MakeSigV4AuthManager to sigv4_auth_manager.cc

4197ceb

Meson: wire SigV4 behind a feature option

f26927e

		ICEBERG_PRECHECK(delegate_type != AuthProperties::kAuthTypeSigV4,
		"Cannot delegate a SigV4 auth manager to another SigV4 auth manager");

		// ---- SigV4 AWS credential entries ----

		/// AWS region for SigV4 signing.

Conversation

plusplusjiajia commented Apr 11, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants