lasdf1234 opened a new issue, #12773:
URL: https://github.com/apache/gravitino/issues/12773
### Describe the feature
Add an `enabled` flag on local IdP users (`idp_user_meta`) so an
administrator can disable a user without deleting the account. Disabled users
cannot authenticate.
Also add `group_comment` to the 1.3.0 → 2.0.0 upgrade scripts so upgraded
clusters match the 2.0.0 schema (`idp_group_meta.group_comment VARCHAR(1024)
DEFAULT ''`). Local IdP tables do not get `external_id`.
### Motivation
Metalake `user_meta` already has `enabled`. Local login identities need the
same control: lock a user out of HTTP Basic without dropping the account.
`group_comment` is already on a fresh 2.0.0 schema but missing from the upgrade
path.
### Describe the solution
- Schema: `idp_user_meta.enabled TINYINT(1) NOT NULL DEFAULT 1` (PostgreSQL
`BOOLEAN NOT NULL DEFAULT TRUE`)
- Create user: optional `enabled`, default `true`
- Update: `PUT /api/idp/users/{user}/enabled` with `{"enabled": false}`
- Authenticate: a disabled user fails with the same unauthorized message as
a bad password
- Keep `idp_group_meta.group_comment` as `VARCHAR(1024) DEFAULT ''` and add
it to the upgrade scripts
- Do not add `external_id` to `idp_user_meta` or `idp_group_meta`
### Additional context
`external_id` belongs on metalake-scoped `user_meta` / `group_meta` only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
