@Rocky how can I check if my external catalog has vended-credentials enabled .? is it set to true by default for external catalogs ?

To check if your external catalog has

vended-credentials

enabled and to understand its default behavior, follow the steps below: 1. How to check if it's enabled You can verify the configuration of any external catalog by running the following SQL command in StarRocks:

sql
SHOW CREATE CATALOG <catalog_name>;

In the output, look for the property:

"iceberg.catalog.vended-credentials-enabled" = "true"

If this property is missing or set to

"false"

, vended credentials are not enabled for that catalog. 2. Is it set to true by default? No,

vended-credentials

is not enabled by default. * Iceberg REST Catalog: This is currently the primary catalog type where this property is used (supported from StarRocks v4.0+). You must explicitly set

"iceberg.catalog.vended-credentials-enabled" = "true"

when creating the catalog to allow the REST server to provide temporary storage credentials to StarRocks. * Other Catalogs: For most other external catalogs (like Glue, Hive, or Unity Catalog), StarRocks typically relies on explicitly configured storage credentials (such as IAM roles, Instance Profiles, or Access Keys) rather than vended credentials from the metastore. Example Configuration If you want to enable it for an Iceberg REST catalog, your creation statement would look like this:

sql
CREATE EXTERNAL CATALOG iceberg_rest_catalog
PROPERTIES (
  "iceberg.catalog.type" = "rest",
  "iceberg.catalog.uri" = "http://<rest_server_endpoint>",
  "iceberg.catalog.vended-credentials-enabled" = "true" -- Must be explicitly set
);

For more details, you can refer to the Iceberg REST Catalog security documentation. References • data_source/catalog/unified_catalog.md

@Rocky I have vended credentails set to false, however sometimes I see the auth errors when connected to my external catalog and list the DB's.

Even if you have

vended-credentials

set to

false

, you may see authentication errors when listing databases due to the distinction between Metastore/API authentication and Storage authentication. 1. Default Value Clarification Contrary to general external catalogs, for the Iceberg REST Catalog (where this property is most relevant),

iceberg.catalog.vended-credentials-enabled

is often set to

true

by default in recent StarRocks versions (v3.2.10+, v3.3.3+, and v4.0+). * When

true

(Default): The Iceberg REST server provides temporary S3/ADLS tokens to StarRocks. * When `false`: StarRocks ignores tokens from the server and relies entirely on the storage credentials you configured in the

PROPERTIES

(e.g.,

aws.s3.access_key

,

aws.s3.use_instance_profile

, etc.). 2. Why

SHOW DATABASES

fails when set to

false

Listing databases (

SHOW DATABASES

) primarily interacts with the Metastore API, but it can fail for several reasons even if you've disabled vended storage credentials: * Metastore API Authentication: To even "talk" to the catalog to list databases, you must satisfy the API security requirements. Check if you have configured: *

"iceberg.catalog.security" = "oauth2"

with a valid

"iceberg.catalog.oauth2.credential"

. *

"iceberg.catalog.security" = "jwt"

(if using StarRocks user-pass-through). If these are missing or the token has expired, the REST server will reject the

listNamespaces

request. * Warehouse Validation: Some REST implementations (like Tabular or Polaris) may attempt to validate the

iceberg.catalog.warehouse

path during the initial connection or listing. If

vended-credentials

is

false

and StarRocks doesn't have an alternative way to access that path (like an IAM role or Instance Profile), the request might trigger an auth error. * Missing Storage Config: If you set vended credentials to

false

, you must provide explicit storage credentials in the catalog properties. If StarRocks tries to fetch any metadata from the storage layer (which sometimes happens during namespace discovery) and those properties are missing, it will fail. 3. How to troubleshoot To pinpoint the error, run the following and check the specific error message: 1. Check StarRocks Permissions: Ensure you have the

USAGE

privilege:

sql
    GRANT USAGE ON CATALOG <catalog_name> TO ROLE public;

2. Verify Catalog Config:

sql
    SHOW CREATE CATALOG <catalog_name>;

If

vended-credentials

is

false

, ensure you have defined storage params (e.g.,

aws.s3.region

,

aws.s3.use_instance_profile

=

true

). 3. Check FE Logs: Look at the

fe.log

on your leader node. If the error is a

401 Unauthorized

or

403 Forbidden

, it is likely the REST API rejecting your credentials, not the storage layer. Recommendation: If your REST server supports it, keeping

vended-credentials

as

true

is generally simpler as it centralizes credential management at the catalog level. References • data_source/catalog/iceberg/iceberg_rest_security.md • data_source/catalog/iceberg/iceberg_catalog.md References • data_source/catalog/iceberg/iceberg_rest_security.md • data_source/catalog/iceberg/iceberg_catalog.md