FrankChen021 commented on PR #20324: URL: https://github.com/apache/druid/pull/20324#issuecomment-5629058842
ROUND_1 closure evidence: INCOMPATIBLE. This PR changes only <extensions-core/druid-pac4j/pom.xml> from pac4j 5.7.10 to 6.5.8, but the exact-head build has deterministic source/API breaks. In [Analyze (java)](https://github.com/apache/druid/actions/runs/34544321826/job/103093543836), [JwtAuthFilter.java:84](https://github.com/apache/druid/blob/d892b68b5144405244b6153157761d59903f1356/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/JwtAuthFilter.java#L84) calls the removed Pac4j 5.x TokenValidator.validate(JWT, Nonce); Pac4j 6.5.8 requires validateIdToken(JWT, Nonce), and [JwtAuthenticator.java:112](https://github.com/apache/druid/blob/d892b68b5144405244b6153157761d59903f1356/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/JwtAuthenticator.java#L112) still calls the removed one-argument TokenValidator constructor. [Pac4jFilter.java:92 and :104](https://github.com/apache/druid/blob/d892b68b5144405244b6153157761d59903f1356/extension s-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java#L92-L104) use the 5.x DefaultCallbackLogic/DefaultSecurityLogic signatures, while 6.5.8 requires FrameworkParameters-based SPI; [Pac4jSessionStore.java:61](https://github.com/apache/druid/blob/d892b68b5144405244b6153157761d59903f1356/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java#L61) uses the removed JEESessionStore.INSTANCE. The same compilation failure propagates through packaging-check, static-checks-maven, strict-compilation, openrewrite, docker-tests, all main unit partitions, and all separated QTests. A bounded metadata-only repair is not sufficient: source calls and tests must be migrated, and the 6.x context/session/HTTP-adapter plus OIDC metadata wiring must be explicitly adapted around Druid's Pac4jAuthenticator and custom encrypted session store. This is therefore not an acceptable version-only bump; closing as incompatible. No deterministic CI rerun was requested. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
