Enable Authentication for Google Sheet Connector Using Delegated User Credentials #25746

Raghav-Modani · 2025-05-07T13:11:23Z

Description

This change lets the Google Sheets connector to authenticate by using delegated user credentials instead of raw service-account identity (which lives outside the domain). By supplying a “delegated user” email address, the connector will:

Obtain domain-wide delegated credentials for that user
Build a Sheets client under the user’s identity

Since the domain of google service account is different from the organization's Google workspace domain, this change allows to share the google sheets only within the Google workspace domain of the organization.

Additional context and related issues

New Config option: gsheets.delegated-user-email
Auth Flow Update: If gsheets.delegated-user-email is set, we load the service-account key, request the delegated credentials for that user, and build the Sheets client with those credentials.
Backward compatibility: Falls back to plain service-account authentication when no delegated user email is provided.

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(x ) Release notes are required, with the following suggested text:

## Google Sheets Connector
* Add support for authentication using delegated user credentials using the `gsheets.delegated-user-email` config property.

cla-bot · 2025-05-07T13:11:26Z

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: Raghav Modani.
This is most likely caused by a git client misconfiguration; please make sure to:

check if your git client is configured with an email to sign commits git config --list | grep email
If not, set it up using git config --global user.email [email protected]
Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails

Praveen2112 · 2025-05-07T13:26:10Z

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsConfig.java

+    @ConfigDescription("Delegated user email to impersonate the service account")
+    public SheetsConfig setDelegatedUserEmail(String delegatedUserEmail)
+    {
+        this.delegatedUserEmail = Optional.ofNullable(delegatedUserEmail);


nit: We don't have to set nullable.

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsConfig.java

Praveen2112 · 2025-05-07T13:30:02Z

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsClient.java

@@ -290,9 +292,12 @@ private static Credential getCredentials(SheetsConfig sheetsConfig)
        throw new TrinoException(SHEETS_BAD_CREDENTIALS_ERROR, "No sheets credentials were provided");
    }

-    private static Credential credentialFromStream(InputStream inputStream)
+    private static Credential credentialFromStream(InputStream inputStream, SheetsConfig sheetsConfig)


instead of passing config we could pass the delegatedUserEmail right ?

cla-bot · 2025-05-07T18:50:14Z

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: Raghav Modani.
This is most likely caused by a git client misconfiguration; please make sure to:

check if your git client is configured with an email to sign commits git config --list | grep email
If not, set it up using git config --global user.email [email protected]
Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails

docs/src/main/sphinx/connector/googlesheets.md

Raghav-Modani · 2025-05-09T06:35:28Z

@ebyhr @Praveen2112 Please review this PR and let me know if any changes are required. Thanks!

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsClient.java

docs/src/main/sphinx/connector/googlesheets.md

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsClient.java

Raghav-Modani · 2025-05-09T13:38:11Z

@Praveen2112 @ebyhr looks like the maven-checks 25-ea is failing consistently. Apart from it, could you please review the latest commits and suggest any changes required?

Praveen2112

Is there is any manual test or validation that this email-id is being used ? Like a manual screenshot based on the history of the sheet ? @ebyhr Any alternatives we could use ?

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsConfig.java

Praveen2112 · 2025-05-09T13:51:03Z

@Raghav-Modani Btw please squash the commit into 1.

Raghav-Modani · 2025-05-13T12:25:10Z

@Raghav-Modani Btw please squash the commit into 1.

Its done. Please review. @Praveen2112 @ebyhr

Praveen2112

LGTM. Can we have a maual test or somesort of a screenshot to ensure the delegated user email is being used.

docs/src/main/sphinx/connector/googlesheets.md

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsConfig.java

Raghav-Modani · 2025-05-13T17:39:37Z

LGTM. Can we have a maual test or somesort of a screenshot to ensure the delegated user email is being used.

Definitely, I will attach some screenshot on the working of this config property here shortly.

ebyhr · 2025-05-13T22:00:32Z

docs/src/main/sphinx/connector/googlesheets.md

+| `gsheets.data-cache-ttl`       | How long to cache spreadsheet data or metadata, defaults to `5m`                  |
+| `gsheets.connection-timeout`   | Timeout when connection to Google Sheets API, defaults to `20s`                   |
+| `gsheets.read-timeout`         | Timeout when reading from Google Sheets API, defaults to `20s`                    |
+| `gsheets.write-timeout`        | Timeout when writing to Google Sheets API, defaults to `20s`                      |


@Raghav-Modani Can you send follow-up PR to change these properties to list-table?

Raghav-Modani · 2025-05-14T12:07:13Z

Screenshots ensuring the delegated user email property is working as expected

Set the gsheets.delegated-user-email property in the configuration file of the connector as shown:

Share the metadata-mapping sheet with the delegated-user-email, no need to share this with the service account's email-id.

Also, share the sheets, which are to be queried, with the same delegated-user-email.

Now, query the sheets. Results are shown below:

Raghav-Modani · 2025-05-14T12:27:59Z

Hey @Praveen2112 , I have attached the screenshots, please check.

Raghav-Modani · 2025-05-15T07:54:29Z

Hey @Praveen2112 @ebyhr , let me know if there are any issues. If not, can we please merge this PR?
Thanks!

ebyhr · 2025-05-15T13:02:32Z

The commit title is too long. Please follow https://trino.io/development/process#pull-request-and-commit-guidelines-

Limit the subject line to 50 characters.

Raghav-Modani · 2025-05-15T14:50:37Z

The commit title is too long. Please follow https://trino.io/development/process#pull-request-and-commit-guidelines-

Limit the subject line to 50 characters.

Hey @ebyhr , changed the commit title and the message body to adhere to the guidelines. I hope this works now. Let me know any other issues to be taken care of?

ebyhr · 2025-05-15T21:58:22Z

@Raghav-Modani Please wrap the commit body at 72 characters. https://trino.io/development/process#pull-request-and-commit-guidelines-

Raghav-Modani · 2025-05-16T08:29:56Z

Hey @ebyhr , changed the commit message body. Please check now.

Raghav-Modani · 2025-05-19T08:56:48Z

@ebyhr @Praveen2112 can we merge it now?

Raghav-Modani · 2025-05-20T05:19:32Z

@Praveen2112 @ebyhr are there any other requirements to be fulfilled to get this PR merged? If not, can we please get this merged? Thanks!

bhargav2427 · 2025-05-21T12:41:08Z

@ebyhr @Praveen2112 Could you please check this Pull Request, we are waiting for this.

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsConfig.java

plugin/trino-google-sheets/src/test/java/io/trino/plugin/google/sheets/TestSheetsConfig.java

Praveen2112

@Raghav-Modani Can you please squash the changes into 1 ?

Enable impersonation of service accounts in Sheets connector.

Raghav-Modani · 2025-05-21T16:21:51Z

@Praveen2112 squashed all the commits into 1.

Raghav-Modani · 2025-05-22T05:16:59Z

Thanks @ebyhr @Praveen2112 for merging this!

github-actions bot added docs google-sheets Google Sheets connector labels May 7, 2025

Praveen2112 reviewed May 7, 2025

View reviewed changes

ebyhr reviewed May 7, 2025

View reviewed changes

docs/src/main/sphinx/connector/googlesheets.md Outdated Show resolved Hide resolved

docs/src/main/sphinx/connector/googlesheets.md Outdated Show resolved Hide resolved

Raghav-Modani force-pushed the gsheets-connector/add-authentication-options branch from c31b73c to f034351 Compare May 8, 2025 05:56

cla-bot bot added the cla-signed label May 8, 2025

github-actions bot added iceberg Iceberg connector delta-lake Delta Lake connector labels May 8, 2025

This comment was marked as resolved.

Sign in to view

Raghav-Modani force-pushed the gsheets-connector/add-authentication-options branch from eae1cf7 to f034351 Compare May 8, 2025 06:25

Raghav-Modani requested review from ebyhr and Praveen2112 May 8, 2025 07:03

ebyhr reviewed May 9, 2025

View reviewed changes

Praveen2112 reviewed May 9, 2025

View reviewed changes

docs/src/main/sphinx/connector/googlesheets.md Outdated Show resolved Hide resolved

Praveen2112 reviewed May 9, 2025

View reviewed changes

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsClient.java Outdated Show resolved Hide resolved

Raghav-Modani marked this pull request as draft May 9, 2025 12:50

Praveen2112 approved these changes May 9, 2025

View reviewed changes

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsConfig.java Show resolved Hide resolved

Raghav-Modani force-pushed the gsheets-connector/add-authentication-options branch from 5618e39 to 70dbec2 Compare May 13, 2025 06:09

Raghav-Modani marked this pull request as ready for review May 13, 2025 06:14

Raghav-Modani requested review from ebyhr and Praveen2112 May 13, 2025 06:15

Praveen2112 approved these changes May 13, 2025

View reviewed changes

docs/src/main/sphinx/connector/googlesheets.md Outdated Show resolved Hide resolved

plugin/trino-google-sheets/src/main/java/io/trino/plugin/google/sheets/SheetsConfig.java Show resolved Hide resolved

ebyhr approved these changes May 13, 2025

View reviewed changes

Raghav-Modani force-pushed the gsheets-connector/add-authentication-options branch from 70dbec2 to cebfe61 Compare May 14, 2025 12:15

Raghav-Modani force-pushed the gsheets-connector/add-authentication-options branch from cebfe61 to ef5d065 Compare May 15, 2025 14:38

Raghav-Modani force-pushed the gsheets-connector/add-authentication-options branch from ef5d065 to 184dee9 Compare May 16, 2025 07:23

Raghav-Modani requested review from ebyhr and Praveen2112 May 21, 2025 05:14

ebyhr reviewed May 21, 2025

View reviewed changes

Praveen2112 approved these changes May 21, 2025

View reviewed changes

Add optional delegated user config for Sheets

ab7eb9d

Enable impersonation of service accounts in Sheets connector.

Raghav-Modani force-pushed the gsheets-connector/add-authentication-options branch from 204e140 to ab7eb9d Compare May 21, 2025 15:04

ebyhr merged commit e0bb9fe into trinodb:master May 21, 2025
18 checks passed

github-actions bot added this to the 476 milestone May 21, 2025

Raghav-Modani deleted the gsheets-connector/add-authentication-options branch May 22, 2025 05:10

Enable Authentication for Google Sheet Connector Using Delegated User Credentials #25746

Enable Authentication for Google Sheet Connector Using Delegated User Credentials #25746

Uh oh!

Conversation

Raghav-Modani commented May 7, 2025

Description

Additional context and related issues

Release notes

Uh oh!

cla-bot bot commented May 7, 2025

Uh oh!

Praveen2112 May 7, 2025

Choose a reason for hiding this comment

Uh oh!

ebyhr May 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Praveen2112 May 7, 2025

Choose a reason for hiding this comment

Uh oh!

cla-bot bot commented May 7, 2025

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Raghav-Modani commented May 9, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Raghav-Modani commented May 9, 2025

Uh oh!

Praveen2112 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Praveen2112 commented May 9, 2025

Uh oh!

Raghav-Modani commented May 13, 2025

Uh oh!

Praveen2112 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Raghav-Modani commented May 13, 2025

Uh oh!

ebyhr May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Raghav-Modani commented May 14, 2025

Screenshots ensuring the delegated user email property is working as expected

Uh oh!

Raghav-Modani commented May 14, 2025

Uh oh!

Raghav-Modani commented May 15, 2025

Uh oh!

ebyhr commented May 15, 2025

Uh oh!

Raghav-Modani commented May 15, 2025

Uh oh!

ebyhr commented May 15, 2025

Uh oh!

Raghav-Modani commented May 16, 2025

Uh oh!

Raghav-Modani commented May 19, 2025

Uh oh!

Raghav-Modani commented May 20, 2025

Uh oh!

bhargav2427 commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ebyhr May 13, 2025 •

edited

Loading

bhargav2427 commented May 21, 2025 •

edited

Loading