Repository navigation
fix: [branch-1.2] fall back to Spark when the driver cannot use the ABFS authentication (#7221) - #7285
Merged
Conversation
…BFS authentication (apache#7221) * fix: fall back to Spark when the driver cannot use the ABFS authentication A native ABFS scan whose authentication Hadoop declines, resolves to a RefreshToken or UserPassword OAuth provider, or fails to resolve on the driver now falls back to Spark's own scan instead of planning natively and failing every task. Closes apache#7202 * fix: keep a URL password out of the ABFS fallback reason * fix: keep a URL password out of Hadoop messages in the ABFS fallback reason Strip the password from the user info wherever a Failed message quotes it, cover the supported OAuth and SAS mechanisms staying native, and add end-to-end fallback tests for Parquet and CSV scans. * fix: fall back for a client credentials endpoint the native ABFS store rejects nativeFallbackReason now declines a Resolved ClientCredsTokenProvider whose endpoint is not https or has no tenant segment, which azure.rs rejects, so the scan reads through Spark instead of failing every task. The reason leaves the endpoint out because it can carry user info. Also reuse resolveS3CompliantSchemes in objectStoreOptionsAndAliasOptions. * fix: fall back for an http Workload Identity authority in the native ABFS scan object_store's token client refuses http, so a Resolved WorkloadIdentityTokenProvider whose fs.azure.account.oauth2.msi.authority is not https plans natively and fails every task, while Hadoop posts to it. nativeFallbackReason now declines it. The reason leaves the authority out because it can carry user info. * fix: ask native whether it can build the ABFS store instead of copying its rules The driver now calls NativeBase.abfsStoreError, which runs azure::create_store on the resolved options, and falls back with native's own message when it fails. The Scala copies of the client credentials endpoint and Workload Identity authority rules are removed. Native rejects an http endpoint or authority when it builds the store, so native writes get that error up front too. * fix: fall back when asking native about the ABFS store fails, and type the probe's arrays Only a LinkageError (the library is not loaded) assumes the store builds. Any other failure from the probe, such as a panic while building the store, would fail every task of a native scan, so it is now a fallback reason. The JNI function takes JObjectArray<JString>, which drops the unsafe JString casts. (cherry picked from commit 61fbbe2)
github-actions
Bot
added
bug
mbutrovich
approved these changes
Oct 28, 2026
mbutrovich
left a comment
mbutrovich
left a comment
Contributor
There was a problem hiding this comment.
Clean cherry-pick, thanks @andygrove!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue does this PR close?
Backport of #7221 to
branch-1.2. #7221 closes #7202 onmain.Part of #7204.
Rationale for this change
Since #6059, the native Parquet and CSV scans resolve ABFS authentication through Hadoop on the driver. When that resolution is something the native store cannot use, the scan still plans natively and every task then fails. 1.1.0 read these scans natively through the ambient identity, so this is a regression in 1.2.0. #7221 makes the scan fall back to Spark's own reader instead.
branch-1.2has the regression, so it needs the fix before 1.2.0 ships. 1.1.0 does not have it, so there is nobranch-1.1backport.What changes are included in this PR?
git cherry-pick -x 61fbbe2e14of the squash commit of #7221, with no adaptations. The cherry-pick applied without conflicts, and the resulting tree is identical to the pick I tested before the source PR merged.It adds
AbfsAuthResolver.nativeFallbackReasonand a new JNI function,NativeBase.abfsStoreError, which runs the native store construction on the driver. It also makesNativeConfig.extractScanObjectStoreOptionsreturn the fallback reason, tightens theazure.rsendpoint checks, and updatesdatasources.md. See #7221 for the full description.How are these changes tested?
On this branch, with a
libcometbuilt from the pick:cargo check --all-targetsinnative/passes.AbfsScanFallbackSuiteandNativeConfigSuitepass, 59 tests.I did not run the other suites that #7221 ran, and I did not confirm that the new tests fail on
branch-1.2without the fix.