Duckdb Polaris Integration does not support multi-tenant with Polaris-Realm header

[CuongNguyen-FinX]

Is your feature request related to a problem? Please describe.
I deployed duckdb and polaris to query iceberg table. The Polaris manage multi-tenant with Polaris Realms. But when using EXTRA_HTTP_HEADERS MAP {'Polaris-Realm': 'REALM1'}, it call Polaris instance with default realm rather than realm in the header.

Describe the solution you'd like
It need to handle Polaris-Realm to enable multi-tenant in Polaris integration.

Additional context
duckdb.sql('''
ATTACH 'my_catalog' AS my_catalog (
TYPE iceberg,
ACCESS_DELEGATION_MODE 'vended_credentials',
ENDPOINT 'xxx',
CLIENT_ID 'xxx',
CLIENT_SECRET 'xxx',
OAUTH2_SERVER_URI 'xxx/v1/oauth/tokens',
EXTRA_HTTP_HEADERS MAP {'Polaris-Realm': 'REALM1'}
);
''')

But from polaris log, it handle with default polaris is POLARIS.

[Tmonster]

Can you provide more documentation around this? Also can you provide some information as to what the duckdb logs say?

call enable_logging('http');
-- run attach commands etc.
select request.type, request.url, request.headers from duckdb_logs_parsed('HTTP');

You should see the headers from EXTRA_HTTP_HEADERS for all catalog requests, but maybe I'm missing something

[davidlazch]

If my understanding is correct, this happens when the IDP used to generate the token is the Polaris server itself.

I have encountered a similar issue but in this case the realm header isn't even sent:

2026-05-12 14:58:29,196 ERROR [org.apa.pol.ser.con.RealmContextFilter] [,] [,,,] (vert.x-eventloop-thread-1) Error resolving realm context: java.lang.IllegalAr
gumentException: Missing required realm header: Polaris-Realm

It happened when I tried to create a secret using the client credentials to obtain a bearer token (with a bearer token itself, DuckDB connects with no issue):

memory D CREATE SECRET iceberg_secret (
                      TYPE iceberg,
                      CLIENT_ID 'clientId',
                      CLIENT_SECRET 'clientSecret',
                      OAUTH2_SERVER_URI 'http://polaris_server:8181/api/catalog/v1/oauth/tokens',
                      EXTRA_HTTP_HEADERS MAP {
                          'Polaris-Realm': 'super-cool-realm'
                      }
                  );

Invalid Configuration Error:
Could not get token from http://polaris_server:8181/api/catalog/v1/oauth/tokens: HTTP NotFound_404 - {"error":{"message":"Missing or invalid realm","type":"MissingOrInvalidRealm","code":404}}

I don't think it's worth fixing/spending time on this as the Polaris server OAUTH2 API will be deprecated anyways, but I might be mistaken.

• Security improvements in the Iceberg REST specification apache/iceberg#10537
• Polaris Catalog OpenAPI Spec

It might be a different issue however, since I don't know if @cuongvikki is using an external IDP or not.

[ndcuong869]

I have the same issue when integrate duckdb and Polaris for multi-tenant. I deploy Polaris with Keycloak. Using the EXTRA_HTTP_HEADERS does not work, the source code show that it ignore EXTRA_HTTP_HEADERS when handle Polaris integration

[CuongNguyen-FinX]

If my understanding is correct, this happens when the IDP used to generate the token is the Polaris server itself.

I have encountered a similar issue but in this case the realm header isn't even sent:

2026-05-12 14:58:29,196 ERROR [org.apa.pol.ser.con.RealmContextFilter] [,] [,,,] (vert.x-eventloop-thread-1) Error resolving realm context: java.lang.IllegalAr
gumentException: Missing required realm header: Polaris-Realm
It happened when I tried to create a secret using the client credentials to obtain a bearer token (with a bearer token itself, DuckDB connects with no issue):

memory D CREATE SECRET iceberg_secret (
TYPE iceberg,
CLIENT_ID 'clientId',
CLIENT_SECRET 'clientSecret',
OAUTH2_SERVER_URI 'http://polaris_server:8181/api/catalog/v1/oauth/tokens',
EXTRA_HTTP_HEADERS MAP {
'Polaris-Realm': 'super-cool-realm'
}
);

Invalid Configuration Error:
Could not get token from http://polaris_server:8181/api/catalog/v1/oauth/tokens: HTTP NotFound_404 - {"error":{"message":"Missing or invalid realm","type":"MissingOrInvalidRealm","code":404}}
I don't think it's worth fixing/spending time on this as the Polaris server OAUTH2 API will be deprecated anyways, but I might be mistaken.

• Security improvements in the Iceberg REST specification apache/iceberg#10537
• Polaris Catalog OpenAPI Spec

It might be a different issue however, since I don't know if @cuongvikki is using an external IDP or not.

I use Keycloak as external IDP for Polaris. Any way to resolve this issues?

[CuongNguyen-FinX]

Can you provide more documentation around this? Also can you provide some information as to what the duckdb logs say?

call enable_logging('http');
-- run attach commands etc.
select request.type, request.url, request.headers from duckdb_logs_parsed('HTTP');
You should see the headers from EXTRA_HTTP_HEADERS for all catalog requests, but maybe I'm missing something

I tried to include EXTRA_HTTP_HEADERS but it does not work. I observed the log from Polaris, it show that the processed request with default POLARIS realm rather than my HEADER realm.

[ndcuong869]

I temporary fix the issue with this PR: https://github.com/dataverses-ai/duckdb-iceberg/tree/feature/polaris. You can try

[CuongNguyen-FinX]

@Tmonster, please let me know the current progress on this feature when you have a moment.

[Tmonster]

Hi @cuongvikki, this is not a huge priority right now, so we haven't taken a serious look.

Do you at observe the extra headers when running select request.headers from duckdb_logs_parsed('HTTP') after attempting to connect to Polaris? That will help determine if DuckDB is dropping the headers, or if Polaris is not receiving them

Can you paste a copy of the SQL you are using (minus any sensitive information) in case you do not see these headers getting passed?