feat(auth): implement SigV4 authentication for REST catalog by plusplusjiajia · Pull Request #616 · apache/iceberg-cpp

plusplusjiajia · 2026-04-11T08:47:05Z

Implement AWS SigV4 authentication for the REST catalog client, following Java's RESTSigV4AuthManager and RESTSigV4AuthSession.

Extend AuthSession::Authenticate() with HTTPRequestContext (method, url, body) for SigV4 request signing
Add SigV4AuthSession: delegate-first auth → relocate conflicting Authorization header → sign with AWS SDK
Add SigV4AuthManager: wraps delegate AuthManager (default OAuth2), resolves credentials from properties or default chain
Body hash matches Java's SignerChecksumParams output: empty body → hex EMPTY_BODY_SHA256; non-empty body → Base64(SHA256(body))

evindj · 2026-04-14T02:01:48Z

src/iceberg/catalog/rest/auth/auth_managers.cc

+  ICEBERG_PRECHECK(delegate_type != AuthProperties::kAuthTypeSigV4,
+                   "Cannot delegate a SigV4 auth manager to another SigV4 auth manager");


add delegate_type in error message?

add delegate_type in error message?

Good idea, done.

evindj · 2026-04-14T02:22:30Z

.github/workflows/cpp-linter.yml

      - name: Install dependencies
        shell: bash
-        run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev
+        run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev ninja-build


n00b question why is ninja-build required here?

Good question — I added a build step in this PR so the linter can see the SigV4 code (needs compile_commands.json from a real build). I used cmake -G Ninja for speed and to be consistent with the other CI workflows, and Ninja is not preinstalled on ubuntu-24.04, hence the extra ninja-build package. Happy to switch to Make if you'd prefer.

evindj · 2026-04-14T02:27:31Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+    if (session_token_it != properties.end() && !session_token_it->second.empty()) {
+      Aws::Auth::AWSCredentials credentials(access_key_it->second.c_str(),
+                                            secret_key_it->second.c_str(),
+                                            session_token_it->second.c_str());
+      return std::make_shared<Aws::Auth::SimpleAWSCredentialsProvider>(credentials);
+    }
+    Aws::Auth::AWSCredentials credentials(access_key_it->second.c_str(),
+                                          secret_key_it->second.c_str());
+    return std::make_shared<Aws::Auth::SimpleAWSCredentialsProvider>(credentials);


Nit: could do only one return if Credentials are created in the conditional statement.

Nit: could do only one return if Credentials are created in the conditional statement.

Nice catch, done.

evindj · 2026-04-14T02:34:46Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+  auto it = properties.find(AuthProperties::kSigV4SigningName);
+  if (it != properties.end() && !it->second.empty()) {
+    return it->second;
+  }


if(properties.count(AuthProperties::kSigV4SigningName) > 0) { // do work }

might be a little less verbose than

auto it = properties.find(AuthProperties::kSigV4SigningName); if (it != properties.end() && !it->second.empty()) { return it->second; }

Thanks for the suggestion! I chose to keep the !it->second.empty() check on purpose — the intent is for an explicitly-empty value (e.g., a env var set to "") to also fall through to the legacy key / default.

evindj · 2026-04-14T02:47:39Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+    const TableIdentifier& table,
+    const std::unordered_map<std::string, std::string>& properties,
+    std::shared_ptr<AuthSession> parent) {
+  auto* sigv4_parent = dynamic_cast<SigV4AuthSession*>(parent.get());


use checked_pointer_cast instead

use checked_pointer_cast instead

Done here as well.

evindj · 2026-04-14T02:48:16Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.cc

+Result<std::shared_ptr<AuthSession>> SigV4AuthManager::ContextualSession(
+    const std::unordered_map<std::string, std::string>& context,
+    std::shared_ptr<AuthSession> parent) {
+  auto* sigv4_parent = dynamic_cast<SigV4AuthSession*>(parent.get());


use checked_pointer_cast

use checked_pointer_cast

Thanks, that's much better! Done.

evindj · 2026-04-14T02:51:39Z

src/iceberg/catalog/rest/auth/sigv4_auth_manager.h

+  std::string signing_region_;
+  std::string signing_name_;
+  std::shared_ptr<Aws::Auth::AWSCredentialsProvider> credentials_provider_;
+  /// Shared signer instance, matching Java's single Aws4Signer per manager.


I find this comment a bit confusing especially given that signer_ is a unique pointer that will be destroyed when SigV4AuthSession is destructed

You're right, sorry about the confusion — the "shared signer" wording was misleading since signer_ is owned per-session via unique_ptr. I've removed the comment.

evindj · 2026-04-14T02:54:50Z

src/iceberg/test/auth_manager_test.cc


  std::unordered_map<std::string, std::string> headers;
-  ASSERT_THAT(session_result.value()->Authenticate(headers), IsOk());
+  ASSERT_THAT(session_result.value()->Authenticate(headers, {}), IsOk());


it feels like Authenticate coudl accept a default value for the second parameter

Good point, thanks! Done

plusplusjiajia force-pushed the sigv4 branch 5 times, most recently from bfc98f7 to 9ddbdbd Compare April 11, 2026 09:35

feat(auth): implement SigV4 authentication for REST catalog

eaa433f

plusplusjiajia force-pushed the sigv4 branch 3 times, most recently from 915c87b to d1c0732 Compare April 11, 2026 11:00

fix(ci): enable SigV4 build in cpp-linter workflow

4326282

plusplusjiajia force-pushed the sigv4 branch from d1c0732 to 4326282 Compare April 11, 2026 11:01

evindj reviewed Apr 14, 2026

View reviewed changes

plusplusjiajia added 2 commits April 14, 2026 11:13

address review feedback

6e12fbd

add single-arg Authenticate() overload

eb74231

		ICEBERG_PRECHECK(delegate_type != AuthProperties::kAuthTypeSigV4,
		"Cannot delegate a SigV4 auth manager to another SigV4 auth manager");

Conversation

plusplusjiajia commented Apr 11, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants