Add support for session timeout property and token refresh setting configuration in Iceberg REST catalog

[varpa89]

Description

RestSessionCatalog can be configured by changing authentication session time to live and enable/disable token refresh mechanics. This change allows to configure these properties from Trino and pass to RestSessionCatalog replacing defaults

iceberg.rest-catalog.session-timeout sets duration to keep authentication session in cache iceberg.rest-catalog.oauth2.token-refresh-enabled controls whether a token should be refreshed if information about its expiration time is available

Additional context and related issues

Trino has multiple options to communicate with Iceberg Rest Catalog in OAUTH2 mode: fill credentials or token when configuring a catalog

Another case can be used when we have enabled Oauth2 for Trino itself and it would be useful to reuse the authentication when communicating with the Iceberg Rest Catalog

Trino's driver has an option extraCredentials that also can be used via X-Trino-Extra-Credential header

Technically it already works, but the problem is that RestSessionCatalog stores this token into the cache, and cache ttl is 1 hour by default. This period can be longer than token's ttl and in this case the Rest Catalog will return 401 error.

private static Cache<String, AuthSession> newSessionCache(Map<String, String> properties) {
  long expirationIntervalMs =
      PropertyUtil.propertyAsLong(
          properties,
          CatalogProperties.AUTH_SESSION_TIMEOUT_MS,
          CatalogProperties.AUTH_SESSION_TIMEOUT_MS_DEFAULT);

  return Caffeine.newBuilder()
      .expireAfterAccess(Duration.ofMillis(expirationIntervalMs))
      .removalListener(
          (RemovalListener<String, AuthSession>)
              (id, auth, cause) -> {
                if (auth != null) {
                  auth.stopRefreshing();
                }
              })
      .build();
}

Cache ttl can be configured and it was discussed here

Another problem is that RestSessionCatalog also tries to refresh the token, but there is an another problem described here. RestSessionCatalog has a property that can just disable token refresh

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
(x) Release notes are required. Please propose a release note for me.
() Release notes are required, with the following suggested text:

[cla-bot]

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

[ebyhr]

Could you follow our commit message guideline?
https://trino.io/development/process.html#pull-request-and-commit-guidelines-

Also, please submit CLA.

[ebyhr]

This assertion is redundant. The following assertFullMapping covers the value.

[varpa89]

removed

[cla-bot]

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

[varpa89]

Could you follow our commit message guideline? https://trino.io/development/process.html#pull-request-and-commit-guidelines-

Also, please submit CLA.

Thank you. Modified the commit message. CLA also submitted, waiting an approve

[cla-bot]

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

[varpa89]

Hi! How do I know if my CLA was accepted or not?

[mayankvadariya]

These CLAs are added in batches, you would be able to see your GH handle in https://github.com/trinodb/cla/commits/master/