lasdf1234 opened a new pull request, #11234:
URL: https://github.com/apache/gravitino/pull/11234
### What changes were proposed in this pull request?
Implement built-in IdP management REST APIs in the `idp-basic` plugin (Fix
#10964):
- **REST resources**: `IdpUserOperations` and `IdpGroupOperations` under
`/api/idp/users` and `/api/idp/groups`
- User: GET/POST/PUT (password reset)/DELETE
- Group: GET/POST/DELETE (`force` query param), membership via `PUT
.../{group}/add` and `PUT .../{group}/remove`
- **Web layer**: `IdpRestUtils` (response helpers + exception mapping),
`IdpDTOConverters`, DTOs in `plugins/idp-basic`
- **Authorization (plugin-only)**: `@IdpManagement` name binding +
`IdpAuthorizationFilter` — APIs are available only when `basic` is in
`gravitino.authenticators`, and caller must be service admin
- **Validation**: `IdpCredentialValidator` in REST DTOs (`AddUserRequest`,
`ResetPasswordRequest`) — username must not contain `:`, password length 12–64
- **Tests**: Jersey unit tests for user/group operations;
`TestIdpRestExtension` verifies `gravitino.server.rest.extensionPackages`
wiring on the server
Enable via server config:
```properties
gravitino.server.rest.extensionPackages = org.apache.gravitino.idp.web.rest
```
No changes to server/core DTOs or `GravitinoInterceptionService`.
### Why are the changes needed?
Local authentication (`design-docs/gravitino-local-authentication.md`)
requires service-admin APIs to manage built-in IdP users and groups. These
endpoints are global (not metalake-scoped) and must be gated when `basic`
authenticator is enabled.
Fix: #10964
### Does this PR introduce _any_ user-facing change?
Yes. New REST APIs under `/api/idp` when the `idp-basic` plugin is on the
classpath and `gravitino.server.rest.extensionPackages` includes
`org.apache.gravitino.idp.web.rest`. No default change to `gravitino.conf`
until operators opt in.
### How was this patch tested?
- `./gradlew :plugins:idp-basic:test -PskipITs`
- `./gradlew :server:test --tests
org.apache.gravitino.server.TestIdpRestExtension -PskipITs`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
