Package org.apache.spark.security

Class FileTokenIngestor

Object
org.apache.spark.security.FileTokenIngestor
All Implemented Interfaces:
TokenIngestor
@Private public class FileTokenIngestor extends Object implements TokenIngestor
A TokenIngestor that reads an OIDC identity token from a file.

The file path is typically a Kubernetes projected service account token (e.g., /var/run/secrets/tokens/spark-identity) or a path configured via spark.security.oidc.identityToken.file.

This implementation:

  • Detects file rotation via mtime change (only re-parses when the file changes)
  • Parses JWT claims by Base64-decoding the payload segment directly, without signature verification, since the token is trusted from the local filesystem and works with both signed (RS256, ES256) and unsigned tokens
  • Handles errors gracefully: malformed JWT, missing file, or empty content returns empty rather than throwing
Since:
4.3.0

  • Constructor Details

    • FileTokenIngestor

      public FileTokenIngestor(Path tokenPath)
      Construct a new FileTokenIngestor.
      Parameters:
      tokenPath - path to the identity token file (must not be null)

  • Method Details

    • load

      public Optional<UserContext> load()
      Description copied from interface: TokenIngestor
      Attempt to load the current identity token and parse it into a UserContext.
      Specified by:
      load in interface TokenIngestor
      Returns:
      a present Optional containing the UserContext if a valid token is available, or empty if unavailable (e.g. empty content / missing file).