Credentials are not output to standard out when following Quickstart

[mjumbewu]

Describe the bug

When following the instructions from the Quickstart there are no lines containing the client secret and id.

To Reproduce

cd ~/polaris
# Build the server
./gradlew clean :polaris-quarkus-server:assemble :polaris-quarkus-server:quarkusAppPartsBuild --rerun
# Start the server
./gradlew run

Actual Behavior

Output is:

Configuration on demand is an incubating feature.

 @@@@   @@@  @       @    @@@@   @  @@@@    @@@@    @  @@@@@  @    @     @@@   @@@@
 @   @ @   @ @      @ @   @   @  @  @@     @       @ @   @   @ @   @    @   @ @     
 @@@@  @   @ @     @@@@@  @@@@   @    @@   @      @@@@@  @  @@@@@  @    @   @ @  @@@
 @      @@@  @@@@ @     @ @  @@  @  @@@@    @@@@ @     @ @ @@   @@ @@@@  @@@   @@@@ 
                                                                                    
                     *
                                                                                    
                                                                                    
                                      /////\                                        
                                   //\\///T\\\                                      
                                ///\\\////\\\\\\                                    
                               //\\\\T////\\\\\\\\\                                 
                          /T\ //\\\\\T///T\\//T\\\\\\                               
                        //\\\/////T\\////\\/////\\\\\\\  //\\                       
                     //\\\\\\T///////////////////T\\\\\\\T\\\\\                     
                  //\\\\/////T\//////////\///////T\\\\\T\\\\\\\\                    
                 //\\\\\/////\\\T////////////////\\\\\\/\\\\\\\\\                   
,,..,,,..,,,..,//\\\\////////\\\\\\\\\\/////////\\\\\///\\\\\\\\\\,,,..,,..,,,..,,,.
,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,..,,,.,,,..,,,..,

                                                           Powered by Quarkus 3.21.2
2025-04-22 18:12:10,610 WARN  [io.qua.config] [,] [,,,] (main) Unrecognized configuration key "quarkus" was provided; it will be ignored; verify that the dependency extension for this configuration is set or that you did not make a typo
2025-04-22 18:12:11,350 WARN  [org.apa.pol.ser.qua.con.ProductionReadinessChecks] [,] [,,,] (main) ⚠️ Production readiness checks failed! Check the warnings below.
2025-04-22 18:12:11,351 WARN  [org.apa.pol.ser.qua.con.ProductionReadinessChecks] [,] [,,,] (main) - The realm context resolver is configured to map requests without a realm header to the default realm. Offending configuration option: 'polaris.realm-context.require-header'.
2025-04-22 18:12:11,352 WARN  [org.apa.pol.ser.qua.con.ProductionReadinessChecks] [,] [,,,] (main) - The current metastore is intended for tests only. Offending configuration option: 'polaris.persistence.type'.
2025-04-22 18:12:11,352 WARN  [org.apa.pol.ser.qua.con.ProductionReadinessChecks] [,] [,,,] (main) - A public key file wasn't provided and will be generated. Offending configuration option: 'polaris.authentication.token-broker.rsa-key-pair.public-key-file'.
2025-04-22 18:12:11,353 WARN  [org.apa.pol.ser.qua.con.ProductionReadinessChecks] [,] [,,,] (main) - The current persistence unit (jdbc:h2) is intended for tests only. Offending configuration option: 'polaris.persistence.eclipselink.configuration-file'.
2025-04-22 18:12:11,353 WARN  [org.apa.pol.ser.qua.con.ProductionReadinessChecks] [,] [,,,] (main) Refer to https://polaris.apache.org/in-dev/unreleased/configuring-polaris-for-production for more information.
2025-04-22 18:12:11,542 INFO  [org.apa.pol.cor.per.LocalPolarisMetaStoreManagerFactory] [,] [,,,] (main) Bootstrapped realm POLARIS using preset credentials.
2025-04-22 18:12:11,704 INFO  [io.quarkus] [,] [,,,] (main) Apache Polaris Server (incubating) 0.10.0-beta-incubating-SNAPSHOT on JVM (powered by Quarkus 3.21.2) started in 3.004s. Listening on: http://0.0.0.0:8181. Management interface listening on http://0.0.0.0:8182.
2025-04-22 18:12:11,705 INFO  [io.quarkus] [,] [,,,] (main) Profile prod activated. 
2025-04-22 18:12:11,706 INFO  [io.quarkus] [,] [,,,] (main) Installed features: [cdi, hibernate-validator, micrometer, opentelemetry, reactive-routes, rest, rest-jackson, security, smallrye-context-propagation, smallrye-health, vertx]

The output says:

Bootstrapped realm POLARIS using preset credentials.

Expected Behavior

Expecting output to contain a string of the form:

realm: POLARIS root principal credentials: <client-id>:<client-secret>

Additional context

I am on Ubuntu 24.04, using OpenJDK 21.

$ uname -a
# Linux xps 6.11.0-21-generic #21~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon Feb 24 16:52:15 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

$ java --version
# openjdk 21.0.6 2025-01-21
# OpenJDK Runtime Environment (build 21.0.6+7-Ubuntu-124.04.1)
# OpenJDK 64-Bit Server VM (build 21.0.6+7-Ubuntu-124.04.1, mixed mode, sharing)

It's a fairly new computer, so I haven't polluted my environment variables with too much cruft yet. Below is the output of printenv | sort (with some values masked) in the terminal where I ran ./gradlew run:

CLUTTER_DISABLE_MIPMAPPED_TEXT=1
COLORTERM=truecolor
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
DEBUGINFOD_URLS=https://debuginfod.ubuntu.com 
DESKTOP_SESSION=ubuntu
DISPLAY=:0
ELECTRON_OZONE_PLATFORM_HINT=auto
GDMSESSION=ubuntu
GNOME_DESKTOP_SESSION_ID=this-is-deprecated
GNOME_SETUP_DISPLAY=:1
GNOME_SHELL_SESSION_MODE=ubuntu
GNOME_TERMINAL_SCREEN=/org/gnome/Terminal/screen/2b05b9af_5309_436f_8818_a5181be831e6
GNOME_TERMINAL_SERVICE=:1.135
GSM_SKIP_SSH_AGENT_WORKAROUND=true
GTK_MODULES=gail:atk-bridge
HOME=/home/****
IM_CONFIG_PHASE=1
LANG=en_US.UTF-8
LESSCLOSE=/usr/bin/lesspipe %s %s
LESSOPEN=| /usr/bin/lesspipe %s
LOGNAME=****
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.crdownload=00;90:*.dpkg-dist=00;90:*.dpkg-new=00;90:*.dpkg-old=00;90:*.dpkg-tmp=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:*.swp=00;90:*.tmp=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90:
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/session.slice/org.gnome.Shell@wayland.service/memory.pressure
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=
PATH=/home/****/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/home/****/.local/bin:/home/****/.local/bin
PWD=/home/****/****/polaris
QT_ACCESSIBILITY=1
QT_IM_MODULE=ibus
SESSION_MANAGER=local/xps:@/tmp/.ICE-unix/4123,unix/xps:/tmp/.ICE-unix/4123
SHELL=/bin/bash
SHLVL=1
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh
SYSTEMD_EXEC_PID=4163
TERM=xterm-256color
USER=****
USERNAME=****
_=/usr/bin/printenv
VTE_VERSION=7600
WAYLAND_DISPLAY=wayland-0
XAUTHORITY=/run/user/1000/.mutter-Xwaylandauth.LXFH52
XDG_CONFIG_DIRS=/etc/xdg/xdg-ubuntu:/etc/xdg
XDG_CURRENT_DESKTOP=ubuntu:GNOME
XDG_DATA_DIRS=/usr/share/ubuntu:/usr/share/gnome:/home/****/.local/share/flatpak/exports/share:/var/lib/flatpak/exports/share:/usr/local/share/:/usr/share/:/var/lib/snapd/desktop
XDG_MENU_PREFIX=gnome-
XDG_RUNTIME_DIR=/run/user/1000
XDG_SESSION_CLASS=user
XDG_SESSION_DESKTOP=ubuntu
XDG_SESSION_TYPE=wayland
XMODIFIERS=@im=ibus

System information

OS: Ubuntu 24.04
Polaris Catalog Version: 0.10.0-beta (64b46f1)

[owenowenisme]

@mjumbewu
I also encountered with this issue when trying out quick start (I was going to file an issue and saw yours), I had to go through the source code and explictly print the secret and finally get this.

realm: POLARIS root principal credentials: root:secret

root & secret is the default credentials I suppose.

[owenowenisme]

Even though the code commented that // Credentials provided in the runtime env... no need to print , but I actually doesnt saw credentials in runtime env.
Does presetCredentials.containsKey(realmId) necessarily mean credentials is provided in runtime env?

If not, do we need to always print the default credentials or maybe add to quick start guide for this?

And also I'm willing to contribute!

polaris/service/common/src/main/java/org/apache/polaris/service/persistence/InMemoryPolarisMetaStoreManagerFactory.java

Lines 103 to 131 in 1c6050b

	public Map<String, PrincipalSecretsResult> bootstrapRealms(
	Iterable<String> realms, RootCredentialsSet rootCredentialsSet) {
	Map<String, PrincipalSecretsResult> results = super.bootstrapRealms(realms, rootCredentialsSet);
	bootstrappedRealms.addAll(results.keySet());
	Map<String, RootCredentials> presetCredentials = rootCredentialsSet.credentials();
	for (String realmId : realms) {
	if (presetCredentials.containsKey(realmId)) {
	// Credentials provided in the runtime env... no need to print
	continue;
	}
	PrincipalSecretsResult principalSecrets = results.get(realmId);
	if (principalSecrets == null) {
	continue; // already bootstrapped (possible benign race)
	}
	String msg =
	String.format(
	"realm: %1s root principal credentials: %2s:%3s",
	realmId,
	principalSecrets.getPrincipalSecrets().getPrincipalClientId(),
	principalSecrets.getPrincipalSecrets().getMainSecret());
	System.out.println(msg);
	}
	return results;
	}
	}

[flyrain]

IIUC, we made the decision that printing credentials isn't necessary as they are part of configuration. In that case, we just need to update the doc. cc @eric-maynard @adutra for more context.

[dimas-b]

Does presetCredentials.containsKey(realmId) necessarily mean credentials is provided in runtime env?

ATM they come either from the POLARIS_BOOTSTRAP_CREDENTIALS OS environment variable or from polaris.bootstrap.credentials system property (the latter can be considered "runtime environment" too, I guess :) )

[dimas-b]

When using ./gradlew run the default creds come from

polaris/quarkus/server/build.gradle.kts

Line 82 in 6308ba0

listOf("-Dpolaris.bootstrap.credentials=POLARIS,root,secret", "-Dquarkus.console.color=true")

[dimas-b]

Since this topic came up, I'd like to remove the printing of auto-generated secrets completely and let the server fail when running with in-memory storage and credentials are not configured.

IMHO, copying random secrets from STDOUT in local dev env. is inconvenient. I personally always use my own secrets which I provide via the POLARIS_BOOTSTRAP_CREDENTIALS env. variable.

Moreover, in production runs, the bootstrap command should be used to create the root principal and credentials will not be printed to server STDOUT anyway.

WDYT?

[owenowenisme]

I think that makes sense.
May I open a pull request to add document and remove the print credentials part?

[dimas-b]

@owenowenisme : Contributions are always welcome 👍

However, if we remove the printing of auto-generated credentials, I believe we ought to fail server startup in that case (to prevent accidentally running into a locked out admin situation).

[owenowenisme]

@dimas-b
So should we also remove setting default credentials for them in this case? Just to make sure our thoughts align.

polaris/quarkus/server/build.gradle.kts

Line 82 in 6308ba0

listOf("-Dpolaris.bootstrap.credentials=POLARIS,root,secret", "-Dquarkus.console.color=true")

[dimas-b]

I do not have a strong opinion on that one... @adutra WDYT?

Maybe we could print something out from the build script in that case?

(TBH, I do not use ./gradlew run personally, I prefer direct java -jar ...)

[adutra]

Indeed .gradlew run uses root:secret. I think it's just a matter of modifying the docs accordingly and telling users to use root:secret.

I agree with not printing any credentials in stdout.

But imho removing the ability to start the server with preset credentials will hurt the developer experience, let's keep that option available, at least some time.

[flyrain]

Agreed with @adutra — we shouldn't remove it. Instead, we should document the behavior (e.g., using ./gradlew run with the preset credential root:secret) in the "Running Polaris as a Standalone Process" section of the quickstart guide.

Also, I noticed that the environment variables don’t seem to be honored while running Polaris as a standalone process. It might be worth fixing that as well.