Implementation:Apache Paimon AuthFactory

Knowledge Sources	Apache_Paimon
Domains	Authentication, Factory Pattern
Last Updated	2026-02-08 00:00 GMT

Overview

AuthFactory provides factory classes for creating authentication providers based on configuration options, including automatic detection of DLF regions and signing algorithms from endpoint URIs.

Description

The AuthFactory module contains two factory classes: DLFAuthProviderFactory and AuthProviderFactory. DLFAuthProviderFactory specializes in creating DLF authentication providers with intelligent defaults, parsing region information from DLF endpoint URIs using regex patterns, and automatically detecting whether to use the default or OpenAPI signing algorithm based on the hostname.

The module handles the complexity of DLF authentication configuration by extracting metadata from URIs. For example, it can parse "cn-hangzhou" from "dlf.cn-hangzhou.aliyuncs.com" and detect that "dlfnext" endpoints require the OpenAPI signing algorithm. This auto-detection reduces configuration burden while allowing explicit override through catalog options.

AuthProviderFactory serves as the main entry point, dispatching to specific provider implementations based on the TOKEN_PROVIDER configuration option. It currently supports two authentication schemes: 'bear' for bearer token authentication and 'dlf' for Alibaba Cloud DLF authentication. The factory pattern enables clean separation between authentication configuration logic and the actual authentication implementations, making it easy to add new authentication providers.

Usage

Use AuthFactory when initializing REST catalog clients that need authentication, allowing catalog options to determine the appropriate authentication mechanism without hardcoding provider selection in application code.

Code Reference

Source Location

• Repository: Apache_Paimon
• File: paimon-python/pypaimon/api/auth/factory.py

Signature

class DLFAuthProviderFactory:
    OPENAPI_IDENTIFIER = "openapi"
    DEFAULT_IDENTIFIER = "default"
    REGION_PATTERN = r'(?:pre-)?([a-z]+-[a-z]+(?:-\d+)?)'

    @staticmethod
    def parse_region_from_uri(uri: Optional[str]) -> Optional[str]:
        pass

    @staticmethod
    def parse_signing_algo_from_uri(uri: Optional[str]) -> str:
        pass

class AuthProviderFactory:

    @staticmethod
    def create_auth_provider(options: Options) -> AuthProvider:
        pass

Import

from pypaimon.api.auth.factory import AuthProviderFactory, DLFAuthProviderFactory

I/O Contract

Inputs

Name	Type	Required	Description
options	Options	Yes	Catalog configuration options containing auth settings
uri	str	No	DLF endpoint URI for auto-detection

Outputs

Name	Type	Description
auth_provider	AuthProvider	Configured authentication provider instance
region	str	Extracted region code from URI
signing_algo	str	Detected signing algorithm ("default" or "openapi")

Usage Examples

from pypaimon.api.auth.factory import AuthProviderFactory, DLFAuthProviderFactory
from pypaimon.common.options import Options

# Create bearer token auth provider
options = Options({
    'token.provider': 'bear',
    'token': 'my-bearer-token-here'
})
provider = AuthProviderFactory.create_auth_provider(options)

# Create DLF auth provider with auto-detection
options = Options({
    'token.provider': 'dlf',
    'uri': 'https://dlf.cn-hangzhou.aliyuncs.com',
    'dlf.access.key.id': 'your-key-id',
    'dlf.access.key.secret': 'your-key-secret',
    'dlf.access.security.token': 'your-security-token'
})
provider = AuthProviderFactory.create_auth_provider(options)
# Automatically detects region="cn-hangzhou", signing_algorithm="default"

# Parse region from URI
region = DLFAuthProviderFactory.parse_region_from_uri(
    "https://dlf.cn-beijing.aliyuncs.com"
)
# Returns: "cn-beijing"

# Detect signing algorithm
algo = DLFAuthProviderFactory.parse_signing_algo_from_uri(
    "https://dlfnext.cn-hangzhou.aliyuncs.com"
)
# Returns: "openapi"

algo = DLFAuthProviderFactory.parse_signing_algo_from_uri(
    "https://dlf.cn-hangzhou.aliyuncs.com"
)
# Returns: "default"

# Explicit override of auto-detected values
options = Options({
    'token.provider': 'dlf',
    'uri': 'https://dlf.cn-hangzhou.aliyuncs.com',
    'dlf.region': 'cn-shanghai',  # Override detected region
    'dlf.signing.algorithm': 'openapi',  # Override detected algorithm
    'dlf.access.key.id': 'your-key-id',
    'dlf.access.key.secret': 'your-key-secret'
})
provider = AuthProviderFactory.create_auth_provider(options)

Related Pages

• Principle:Apache_Paimon_Authentication