Santoshkumarpuppala opened a new pull request, #14601: URL: https://github.com/apache/gravitino/pull/14601
### What changes were proposed in this pull request? For Bearer and other non-Basic schemes, the audit principal is now the first 16 hex characters of the SHA-256 of the whole credential. Before it was the first 8 characters of the credential. JWT claims are not read, and Basic is unchanged. The docs row for `principal` is updated. ### Why are the changes needed? The first 8 characters of a JWT come from its header, so callers whose tokens share a header all got the same principal. Tokens of 8 characters or less were also logged in full. Fixes #11571 ### Does this PR introduce _any_ user-facing change? Yes, the `principal` value in the audit log has a new format. A refreshed token gets a new value. The OAuth service identity goes through the same function as a caller's header, so it is hashed too. `oauth:mcp-serv` becomes `oauth:0d315e3c73d7840c`. The client ID is still in the startup log. The hash has no key, so the same token keeps the same value across restarts and replicas. Let me know if you would prefer a keyed hash with a configured secret. ### How was this patch tested? `uv run pytest tests/unit/` gives 316 passed. The new tests cover JWTs for different users with the same header, the same claims with a different signature, the audit record from the middleware, and a token that is not valid UTF-8. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
