New OAuth2AuthManager

[sungwy]

Rationale for this change

New OAuth2Manager implementation that makes use of AuthManager and more closely follows https://datatracker.ietf.org/doc/html/rfc6749 recommendations. It injects the encoded secret into the Basic header against the authentication server, as recommended by the RFC instead of injecting it into the request body, which is less secure.

Proactively refreshes the access token by checking the expiration.

Are these changes tested?

Yes, both in unit and integration tests.

Are there any user-facing changes?

No, this is a new feature.

[kevinjqliu]

Generally LGTM, a few nit comments. Lets get #2055 merged and then rebase this PR

[kevinjqliu]

do we have any tests for LegacyOAuth2AuthManager? do we want OAuth2AuthManager to be feature parity in this first release?

[kevinjqliu]

i dont see credential, resource, and audience

iceberg-python/mkdocs/docs/configuration.md

Lines 368 to 371 in 4cac691

	| credential | client_id:client_secret | Credential to use for OAuth2 credential flow when initializing the catalog |
	| scope | openid offline corpds:ds:profile | Desired scope of the requested security token (default : catalog) |
	| resource | rest_catalog.iceberg.com | URI for the target resource or service |
	| audience | rest_catalog | Logical name of target resource or service |

[sungwy]

we are using client_id and client_secret instead in the current implementation, as opposed to credential. This is also currently in draft mode, and I intend to review OAuth2 spec a little bit more in depth and other industry standard implementations before finalizing the implementation.

[sungwy]

I researched the IETF RFCs on OAuth closely, and my understanding is that resource and audience parameters were introduced in subsequent RFCs as supplemental parameters. What do you think about merging this version of the OAuth2AuthManager that closely follows the initial RFC6749 and introducing those as followup PRs?

[kevinjqliu]

make sense! thanks for looking into it

[kevinjqliu]

i took the liberty to merge main :)

[Copilot]

Pull Request Overview

This PR introduces a new OAuth2Manager implementation that more closely follows RFC6749 standards, replacing the legacy OAuth2 implementation. The new implementation includes proactive token refresh capabilities based on expiration times.

• Adds a new OAuth2AuthManager with RFC6749-compliant implementation
• Introduces thread-safe OAuth2TokenProvider for token management with automatic refresh
• Updates documentation to reflect the new oauth2 auth type and deprecates legacyoauth2

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pyiceberg/catalog/rest/auth.py	Implements OAuth2TokenProvider and OAuth2AuthManager classes with thread-safe token refresh
tests/catalog/test_rest.py	Adds integration test for the new oauth2 authentication type
mkdocs/docs/configuration.md	Updates documentation to include oauth2 configuration and marks legacyoauth2 as deprecated

[kevinjqliu]

LGTM!

With this change,

        data = {
            "grant_type": "client_credentials"
        }

I was able to verify locally with Microsoft Entra, which is also an Oauth2 provider :)

[kevinjqliu]

make sense! thanks for looking into it