This is an automated email from the ASF dual-hosted git repository.
zaynt4606 pushed a commit to branch branch-0.7
in repository https://gitbox.apache.org/repos/asf/celeborn.git
The following commit(s) were added to refs/heads/branch-0.7 by this push:
new cc0d964037 [CELEBORN-2456] Fix wrong isAssignableFrom direction in
Basic/Bearer authenticationSupported
cc0d964037 is described below
commit cc0d9640379ce739450bea91d6d6dcc184086dec
Author: yew1eb <[email protected]>
AuthorDate: Sat Oct 10 15:10:34 2026 +0800
[CELEBORN-2456] Fix wrong isAssignableFrom direction in Basic/Bearer
authenticationSupported
### What changes were proposed in this pull request?
Fix the reversed `isAssignableFrom` direction in
`BasicAuthenticationHandler` and `BearerAuthenticationHandler` (its result was
also discarded, making the check a no-op), and fail fast in
`AuthenticationFilter.init` when schemes are configured but no handler is
registered.
### Why are the changes needed?
The broken check lets invalid providers pass startup validation; if the
provider class cannot be loaded and it is the only configured scheme, all
requests are silently served without authentication.
### Does this PR resolve a correctness bug?
- [ ] Yes
### Does this PR introduce _any_ user-facing change?
- [ ] Yes
### How was this patch tested?
Added `AuthenticationHandlerSuite`
Closes #3841 from yew1eb/CELEBORN-2456.
Authored-by: yew1eb <[email protected]>
Signed-off-by: zhengtao <[email protected]>
AI-Contributed/Feature: 0/11
AI-Contributed/UT: 0/52
(cherry picked from commit 9dfb74bdaaa3af217b3b80e0fc4e183a3ba74f90)
Signed-off-by: zhengtao <[email protected]>
---
.../http/authentication/AuthenticationFilter.scala | 5 +++
.../BasicAuthenticationHandler.scala | 3 +-
.../BearerAuthenticationHandler.scala | 3 +-
.../AuthenticationHandlerSuite.scala | 52 ++++++++++++++++++++++
4 files changed, 59 insertions(+), 4 deletions(-)
diff --git
a/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationFilter.scala
b/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationFilter.scala
index 55274fc8a4..3a760c6ac4 100644
---
a/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationFilter.scala
+++
b/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationFilter.scala
@@ -113,6 +113,11 @@ class AuthenticationFilter(conf: CelebornConf,
serviceName: String) extends Filt
override def init(filterConfig: FilterConfig): Unit = {
initAuthHandlers()
+ if (authSchemes.nonEmpty && authSchemeHandlers.isEmpty) {
+ throw new ServletException(
+ s"No authentication handler registered for the configured schemes" +
+ s" ${authSchemes.mkString(", ")}, refusing to serve requests without
authentication")
+ }
}
private[celeborn] def getMatchedHandler(authorization: String):
Option[AuthenticationHandler] = {
diff --git
a/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BasicAuthenticationHandler.scala
b/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BasicAuthenticationHandler.scala
index 03703fbcec..e5d8ba5399 100644
---
a/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BasicAuthenticationHandler.scala
+++
b/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BasicAuthenticationHandler.scala
@@ -43,8 +43,7 @@ class BasicAuthenticationHandler(providerClass: String)
extends AuthenticationHa
override def authenticationSupported: Boolean = {
Option(providerClass).exists { _ =>
try {
-
Class.forName(providerClass).isAssignableFrom(classOf[PasswdAuthenticationProvider])
- true
+
classOf[PasswdAuthenticationProvider].isAssignableFrom(Class.forName(providerClass))
} catch {
case _: Throwable => false
}
diff --git
a/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BearerAuthenticationHandler.scala
b/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BearerAuthenticationHandler.scala
index fd93560c4e..d5b8e985ba 100644
---
a/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BearerAuthenticationHandler.scala
+++
b/service/src/main/scala/org/apache/celeborn/server/common/http/authentication/BearerAuthenticationHandler.scala
@@ -42,8 +42,7 @@ class BearerAuthenticationHandler(providerClass: String)
override def authenticationSupported: Boolean = {
Option(providerClass).exists { _ =>
try {
-
Class.forName(providerClass).isAssignableFrom(classOf[TokenAuthenticationProvider])
- true
+
classOf[TokenAuthenticationProvider].isAssignableFrom(Class.forName(providerClass))
} catch {
case _: Throwable => false
}
diff --git
a/service/src/test/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationHandlerSuite.scala
b/service/src/test/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationHandlerSuite.scala
new file mode 100644
index 0000000000..77298fc372
--- /dev/null
+++
b/service/src/test/scala/org/apache/celeborn/server/common/http/authentication/AuthenticationHandlerSuite.scala
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.celeborn.server.common.http.authentication
+
+import javax.servlet.ServletException
+
+import org.apache.celeborn.CelebornFunSuite
+import org.apache.celeborn.common.CelebornConf
+import org.apache.celeborn.server.common.Service
+
+class AuthenticationHandlerSuite extends CelebornFunSuite {
+
+ test("basic handler supports providers implementing
PasswdAuthenticationProvider") {
+ assert(new BasicAuthenticationHandler(
+
classOf[UserDefinedPasswordAuthenticationProviderImpl].getName).authenticationSupported)
+ assert(!new BasicAuthenticationHandler(
+
classOf[UserDefineTokenAuthenticationProviderImpl].getName).authenticationSupported)
+ assert(!new
BasicAuthenticationHandler("non.existent.Provider").authenticationSupported)
+ }
+
+ test("bearer handler supports providers implementing
TokenAuthenticationProvider") {
+ assert(new BearerAuthenticationHandler(
+
classOf[UserDefineTokenAuthenticationProviderImpl].getName).authenticationSupported)
+ assert(!new BearerAuthenticationHandler(
+
classOf[UserDefinedPasswordAuthenticationProviderImpl].getName).authenticationSupported)
+ assert(!new
BearerAuthenticationHandler("non.existent.Provider").authenticationSupported)
+ }
+
+ test("fail fast when no handler registered for the configured schemes") {
+ val conf = new CelebornConf()
+ conf.set(CelebornConf.MASTER_HTTP_AUTH_SUPPORTED_SCHEMES, Seq("BASIC"))
+ conf.set(CelebornConf.MASTER_HTTP_AUTH_BASIC_PROVIDER,
"non.existent.Provider")
+ intercept[ServletException] {
+ new AuthenticationFilter(conf, Service.MASTER).init(null)
+ }
+ }
+}
