Getting Started with Apache Polaris, External Authentication and Keycloak

Mon, 01 Jan 0001 00:00:00 +0000

Overview🔗

This example uses Keycloak as an external identity provider for Polaris. The “iceberg” realm is automatically created and configured from the iceberg-realm.json file.

This Keycloak realm contains 1 client definition: client1:s3cr3t. It is configured to return tokens with the following fixed claims:

principal_id: the principal ID of the user. It is always set to zero (0) in this example.
principal_name: the principal name of the user. It is always set to “root” in this example.
principal_roles: the principal roles of the user. It is always set to ["server_admin", "catalog_admin"] in this example.

This is obviously not a realistic configuration. In a real-world scenario, you would configure Keycloak to return the actual principal ID, name and roles of the user. Note that principals and principal roles must have been created in Polaris beforehand, and the principal ID, name and roles must match the ones returned by Keycloak.

Getting Started with Apache Polaris, Prometheus and Jaeger

Mon, 01 Jan 0001 00:00:00 +0000

This example requires jq to be installed on your machine.

Build the Polaris image if it’s not already present locally:

1./gradlew \
2 :polaris-server:assemble \
3 :polaris-server:quarkusAppPartsBuild --rerun \
4 -Dquarkus.container-image.build=true

Start the docker compose group by running the following command from the root of the repository:
```
1docker compose -f getting-started/telemetry/docker-compose.yml up
```
To access Polaris from the host machine, first request an access token:

Using Polaris on Apache Polaris

Getting Started with Apache Polaris, External Authentication and Keycloak

Overview🔗

Getting Started with Apache Polaris, Prometheus and Jaeger