From 978cb0f64c13bd59524b903dc07621ce1bdfa41e Mon Sep 17 00:00:00 2001
From: water <672684719@qq.com>
Date: Tue, 11 Aug 2026 07:45:18 +0800
Subject: [PATCH] fix: clear inherited credential on token-exchange derived
 sessions

---
 .../org/apache/iceberg/rest/auth/OAuth2Util.java    | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java b/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java
index b8db459edebd..c0242c11cf1d 100644
--- a/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java
+++ b/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java
@@ -734,7 +734,18 @@ public static AuthSession fromTokenExchange(
               parent.scope(),
               parent.oauth2ServerUri(),
               parent.optionalOAuthParams());
-      return fromTokenResponse(client, executor, response, startTimeMillis, parent);
+      AuthSession session = fromTokenResponse(client, executor, response, startTimeMillis, parent);
+      // A session created by token exchange should be refreshed via token exchange,
+      // not by falling back to the parent's client credential. Clear the inherited
+      // credential and enable exchange on the child session so that refresh always
+      // uses the token exchange flow, independent of the catalog-level exchangeEnabled flag.
+      session.config =
+          AuthConfig.builder()
+              .from(session.config)
+              .credential(null)
+              .exchangeEnabled(true)
+              .build();
+      return session;
     }
   }
 }