raghav-reglobe opened a new pull request, #67792:
URL: https://github.com/apache/doris/pull/67792
### What problem does this PR solve?
Issue Number: close #67791
Related PR: none
Problem Summary:
`CREATE USER ... ACCOUNT_LOCK` parsed but did nothing, and `ALTER USER ...
ACCOUNT_LOCK` was refused with "Not support lock account now". The only lock
Doris had was the failed-login one, whose counter and lock time are
deliberately in-memory and per FE, so it clears on a restart or a master switch
and never applies cluster-wide. There was no durable way to stop an account
from authenticating without dropping it.
### Release note
Support the MySQL-compatible administrative account lock: `ALTER USER ...
ACCOUNT_LOCK | ACCOUNT_UNLOCK` and `CREATE USER ... ACCOUNT_LOCK`. A locked
account is refused at authentication with `ER_ACCOUNT_HAS_BEEN_LOCKED` (3118);
the lock is persisted and journaled, so it holds on every FE and across
restarts; `ACCOUNT_UNLOCK` also resets the failed-login lock; `SHOW CREATE
USER` prints `ACCOUNT_LOCK`.
### Check List (For Author)
- Test <!-- At least one of them must be included. -->
- [x] Regression test:
`regression-test/suites/account_p0/test_account_lock.groovy`
- [x] Unit Test: `AccountLockTest` (lock/unlock via SQL, `CREATE USER
... ACCOUNT_LOCK`, policy edits keep the lock, `ACCOUNT_UNLOCK` clears a
failed-login lock, journal replay, GSON round trip including an image written
before the field); `AlterUserCommandTest` updated
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- Behavior changed:
- [ ] No.
- [x] Yes. `ALTER USER ... ACCOUNT_LOCK` now succeeds instead of failing
analysis, and `CREATE USER ... ACCOUNT_LOCK` now takes effect. Both were
documented syntax with no effect before. `ACCOUNT_UNLOCK` additionally clears
the administrative lock.
- Does this need documentation?
- [ ] No.
- [x] Yes. `CREATE USER` / `ALTER USER` reference: `ACCOUNT_LOCK` /
`ACCOUNT_UNLOCK` semantics (authentication-only check, existing sessions
unaffected, `ACCOUNT_UNLOCK` resets failed-login tracking). Docs PR to follow
once the shape is agreed.
### Design
- `PasswordPolicy.FailedLoginPolicy` gains a persisted `manuallyLocked` flag
(`@SerializedName`, rides the existing GSON image path; an image written before
the field deserializes unlocked).
- `ALTER USER ... ACCOUNT_LOCK` becomes a real
`AlterUserOpType.LOCK_ACCOUNT` operation. The enum value has existed for years,
so it is journaled through the ordinary `OP_ALTER_USER` path and an older
binary replays it as an unknown operation without failing. `ACCOUNT_UNLOCK`
clears the flag and, as in MySQL, resets the failed-login state.
- `CREATE USER ... ACCOUNT_LOCK` is honored through `PasswordPolicy.update`.
- Enforcement lives in
`PasswordPolicy.checkAccountLockedAndPasswordExpiration`, i.e. password
authentication only, with a new `ErrorCode.ERR_ACCOUNT_HAS_BEEN_LOCKED` (3118,
`Access denied for user '%s'@'%s'. Account is locked.`). Sessions already
authenticated are untouched (MySQL semantics).
- `SHOW CREATE USER` prints `ACCOUNT_LOCK` from a new
`password_policy.account_locked` row appended to the policy info (appended
last, so existing consumers' indices are unchanged).
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label <!-- Add branch pick label that this PR should
merge into -->
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
