Iceberg REST Catalog Settings

This page documents the settings that control how clients authenticate to the AIStor Tables Iceberg REST catalog, and whether the catalog vends storage credentials.

For how each query engine uses these settings, see Connecting query engines to AIStor Tables.

MINIO_TABLES_OAUTH_TOKEN_ENABLED=on
MINIO_TABLES_OAUTH_TOKEN_EXPIRY=1h
MINIO_TABLES_VENDED_CREDENTIALS_ENABLED=off
MINIO_TABLES_VENDED_CREDENTIALS_EXPIRY=1h

mc admin config set ALIAS tables        \
   oauth_token_enabled=on               \
   oauth_token_expiry="1h"              \
   vended_credentials_enabled=off       \
   vended_credentials_expiry="1h"

Enable the OAuth2 client-credentials token endpoint at POST /_iceberg/v1/oauth/tokens, and Bearer authentication on the catalog routes.

Valid values are on or off. When set to off, the token endpoint returns 404 and the catalog accepts SigV4 requests only.

Defaults to on.

A client passes an AIStor access key as client_id and the matching secret key as client_secret, and receives an AIStor session token to send as Authorization: Bearer. The credentials may belong to the root user, an IAM user, or a service account.

A session token a client already holds, from AssumeRole, OIDC, LDAP, or mc, is also accepted directly as a Bearer token without a call to this endpoint.

The endpoint enforces the following:

• Only grant_type=client_credentials.
• Credentials in the request body or the Authorization header, never in the query string.
• A Content-Type of application/x-www-form-urlencoded.
• A TLS-secured connection, on a deployment configured for TLS. A proxy that terminates TLS must forward X-Forwarded-Proto: https.

The endpoint shares the Security Token Service rate limits, so an exhausted budget returns 429 with a Retry-After header.

Set how long an issued access token remains valid.

Specify a Go-compatible duration string between 15m and 12h, such as 1h or 30m.

Defaults to 1h.

Enable vended storage credentials in LoadTable, CreateTable, and RegisterTable responses.

Valid values are on or off.

Defaults to off.

A client asks for vended credentials with the X-Iceberg-Access-Delegation: vended-credentials request header. MinIO AIStor then returns short-lived S3 credentials scoped by an inline session policy to that table’s prefix. A client that receives them needs no separately configured S3 credentials to read the table’s data files.

Vending never widens access. The credentials carry only the data actions the caller already holds on the table, bounded by its s3tables:GetTableData and s3tables:PutTableData permissions. A caller with read-only access receives read-only credentials, and a caller with no data access receives none. Most deployments therefore do not need this setting, which is why it is off by default. Turn it on for a client that cannot use its own credentials against object storage directly.

MinIO AIStor returns no credentials, and the response is unchanged, when:

• The caller is anonymous.
• The caller’s own credential already carries an inline session policy, such as an embedded service account. The vended credential has one session-policy slot, which the table scope occupies, so the caller’s policy could not be carried.
• The table has no single resolvable storage prefix, such as a staged table or a registered table whose metadata was relocated.

A request that asks for delegation over an insecure transport, on a deployment configured for TLS, fails rather than returning a response without credentials. A proxy that terminates TLS counts as secure when it forwards X-Forwarded-Proto: https and the deployment’s trusted-proxy allowlist accepts it.

Each decision is recorded on the request’s audit entry under the iceberg:vendedCredentials tag, and counted in minio_tables_vended_credentials_total. The result label reports issued, denied, insecure, unscopable, session-policy, or error.

Set how long vended storage credentials remain valid.

Specify a Go-compatible duration string between 15m and 12h, such as 1h or 30m.

Defaults to 1h.