xiangfu0 opened a new pull request, #19233: URL: https://github.com/apache/pinot/pull/19233
## Summary - apply the configured Server `AccessControlFactory` centrally across the admin listener - keep the three health/readiness declarations public and preserve table-level checks for the two data-download declarations - define a Server-specific administrative authorization contract for built-in and custom access-control implementations - attach configurable service identities to in-scope Controller and Broker calls to protected Server operations - document the route inventory, rolling migration, default behavior, and the separate Minion trust-boundary assumption The inventoried boundary is 3 public JAX-RS declarations, 2 table-data declarations, 48 privileged JAX-RS declarations, and 3 privileged static-handler prefixes. New or custom routes fail closed as privileged unless the built-in classification is deliberately extended. ## Root cause and reproduction The Server admin application bound an `AccessControlFactory`, but only handlers that explicitly performed table-data authorization consulted it. As a result, configuring Server access control did not consistently cover non-table administrative operations. To reproduce the previous behavior, configure a Server access-control factory and send an unauthenticated request to a non-table administrative operation. The request could reach the resource without consulting the configured factory. With this change, missing or invalid credentials receive 401, authenticated identities without administrative authority receive 403, and authorized administrators succeed. ## Compatibility - Existing table-data authorization remains in the resource methods. - `AllowAllAccessFactory` preserves the unconfigured/default behavior. - The additive `authorizeAdminAccess` SPI method defaults to deny, so custom implementations remain binary compatible and must opt into administrative access explicitly. - Basic authentication requires an explicit `admin` permission; ZK-backed authentication requires role `ADMIN` and component `SERVER`. - Controller and Broker service credentials can be configured before enabling the Server boundary for rolling upgrades. - Minion code is unchanged. Deployments using protected Server listeners with affected task paths must retain a trusted internal network or inject identity at a proxy/service-mesh boundary. ## Validation - 112 targeted tests passed across Server authorization, table-data, health/readiness, static handlers, AllowAll, ZK auth, shared HTTP transport, Controller/Broker internal calls, and protected-cluster integration coverage. - `spotless:apply`, `license:format`, `checkstyle:check`, and `license:check` passed for all affected modules. - Warning-enabled `test-compile` passed for all affected modules. - `git diff --check` passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
