[REST Catalog] OAuth 2 grant type "refresh_token" not implemented #12196

Apache Iceberg version

1.7.1 (latest release)

Query engine

None

Feature Request / Improvement

For the REST Catalog service (after deprecating the oauth endpoint), the refresh token flow (https://datatracker.ietf.org/doc/html/rfc6749#section-6) is not supported yet. The current supported flow is "token-exchange" and used as a way to refresh tokens: https://github.com/apache/iceberg/blob/main/core/src/main/java/org/apache/iceberg/rest/auth/OAuth2Util.java#L163.

The refresh token flow should be taking in:

1. Basic auth header: "Authorization: Basic ${base64_encoded_colon_separated_client_id_and_secret}" (depending on the authorization server implementation, sometimes Bearer token also works).
2. Form data: "grant_type=refresh_token&refresh_token=..." (optionally plaintext client id and secret if not provided through auth header).

A proposal to support this flow is to allow providing:

1. refresh_token
2. client id and secret (or a base64 encoded string of both)

through properties similar to credential or token to work together with the oauth2-server-uri property.

Willingness to contribute

• I can contribute a fix for this bug independently
• I would be willing to contribute a fix for this bug with guidance from the Iceberg community
• I cannot contribute a fix for this bug at this time