Be Able to Configure an External Catalog to Use org.apache.iceberg.gcp.auth.GoogleAuthManager as it's AuthManager

[adam-christian-software]

Is your feature request related to a problem? Please describe.

A few folks want to have an external table use GoogleAuthManager.

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional context

No response

[PhillHenry]

Just to add some more context mentioned in our Slack chat:

• Iceberg can talk to Google no problem using org.apache.iceberg.gcp.auth.GoogleAuthManager.
• However, there is currently no Polaris code to use GoogleAuthManager in an external catalog.
• Instead, the only way to do it currently is to use the standard OAuth2 code.
• However, Google does not completely follow the OAuth2 spec, hence this Iceberg ticket that lead to the writing of GoogleAuthManager and this StackOverflow post that says GCP does not support the grant_type that Iceberg's OAuth2Util uses.

[PhillHenry]

Running the SQL s"CREATE NAMESPACE IF NOT EXISTS $FEDERATED_CATALOG_NAME.$namespace" results in this error in my client Spark code that uses the GCP Federated catalog that was successfully created:

Malformed request: Malformed request: unsupported_grant_type: Invalid grant_type: client_credentials
org.apache.iceberg.exceptions.BadRequestException: Malformed request: Malformed request: unsupported_grant_type: Invalid grant_type: client_credentials
	at org.apache.iceberg.rest.ErrorHandlers$NamespaceErrorHandler.accept(ErrorHandlers.java:183)
	at org.apache.iceberg.rest.ErrorHandlers$NamespaceErrorHandler.accept(ErrorHandlers.java:173)
	at org.apache.iceberg.rest.HTTPClient.throwFailure(HTTPClient.java:240)
	at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:336)
	at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:297)
	at org.apache.iceberg.rest.BaseHTTPClient.get(BaseHTTPClient.java:77)
	at org.apache.iceberg.rest.RESTClient.get(RESTClient.java:88)
	at org.apache.iceberg.rest.RESTSessionCatalog.loadNamespaceMetadata(RESTSessionCatalog.java:623)
	at org.apache.iceberg.catalog.BaseSessionCatalog$AsCatalog.loadNamespaceMetadata(BaseSessionCatalog.java:138)
	at org.apache.iceberg.rest.RESTCatalog.loadNamespaceMetadata(RESTCatalog.java:242)
	at org.apache.iceberg.spark.SparkCatalog.loadNamespaceMetadata(SparkCatalog.java:463)
	at org.apache.spark.sql.connector.catalog.SupportsNamespaces.namespaceExists(SupportsNamespaces.java:98)```

using org.apache.iceberg:iceberg-spark-runtime-3.5_2.12:jar:1.10.0 on the client JVM.

On the Polaris side (commit f0ede57951810e1bac2812e4e6498d261e09d4d5) the logs look like:

2026-02-04 13:19:13,883 INFO  [org.apa.ice.res.aut.AuthManagers] [1f92f653-6f01-4197-84bc-ce9b4d9b5c62_0000000000000000010,POLARIS] [,,,] (executor-thread-1) Loading AuthManager implementation: org.apache.iceberg.rest.auth.OAuth2Manager                                                                                                
2026-02-04 13:19:14,207 DEBUG [org.apa.pol.ser.cat.ice.IcebergCatalogAdapter] [1f92f653-6f01-4197-84bc-ce9b4d9b5c62_0000000000000000010,POLARIS] [,,,] (executor-thread-1) RuntimeException while operating on catalog. Propagating to caller.: org.apache.iceberg.exceptions.BadRequestException: Malformed request: unsupported_grant_type: Invalid grant_type: client_credentials                                                                                                                              
        at org.apache.iceberg.rest.ErrorHandlers$OAuthErrorHandler.accept(ErrorHandlers.java:280)                                                                     
        at org.apache.iceberg.rest.ErrorHandlers$OAuthErrorHandler.accept(ErrorHandlers.java:254)                                                                     
        at org.apache.iceberg.rest.HTTPClient.throwFailure(HTTPClient.java:240)                                                                                       
        at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:336)                                                                                            
        at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:297)                                                                                            
        at org.apache.iceberg.rest.BaseHTTPClient.postForm(BaseHTTPClient.java:136)                                                                                   
        at org.apache.iceberg.rest.auth.OAuth2Util.fetchToken(OAuth2Util.java:291)                                                                                    
        at org.apache.iceberg.rest.auth.OAuth2Manager.initSession(OAuth2Manager.java:87)                                                                              
        at org.apache.iceberg.rest.auth.OAuth2Manager.initSession(OAuth2Manager.java:40)                                                                              
        at org.apache.iceberg.rest.RESTSessionCatalog.initialize(RESTSessionCatalog.java:204)                                                                         
        at org.apache.iceberg.rest.RESTCatalog.initialize(RESTCatalog.java:82)                                                                                        
        at org.apache.polaris.service.catalog.iceberg.IcebergRESTExternalCatalogFactory.createCatalog(IcebergRESTExternalCatalogFactory.java:57)                      
        at org.apache.polaris.service.catalog.iceberg.IcebergRESTExternalCatalogFactory_ClientProxy.createCatalog(Unknown Source)                                     
        at org.apache.polaris.service.catalog.iceberg.IcebergCatalogHandler.initializeCatalog(IcebergCatalogHandler.java:303)                                         
        at org.apache.polaris.service.catalog.common.CatalogHandler.authorizeBasicNamespaceOperationOrThrow(CatalogHandler.java:162)                                  
        at org.apache.polaris.service.catalog.common.CatalogHandler.authorizeBasicNamespaceOperationOrThrow(CatalogHandler.java:106)                                  
        at org.apache.polaris.service.catalog.iceberg.IcebergCatalogHandler.loadNamespaceMetadata(IcebergCatalogHandler.java:368)                                     
        at org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.lambda$loadNamespaceMetadata$2(IcebergCatalogAdapter.java:230)                            
        at org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.withCatalogByName(IcebergCatalogAdapter.java:161)                                         
        at org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.withCatalog(IcebergCatalogAdapter.java:153)                                               
        at org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.loadNamespaceMetadata(IcebergCatalogAdapter.java:229)