mattcasters opened a new pull request, #8335: URL: https://github.com/apache/hop/pull/8335
Let plugin `/hop/*` servlets opt into Hop Web RBAC, and let JDBC/API clients authenticate with `Authorization: Bearer` when Hop Web is in BASIC or OAUTH2 mode. This is the Hop-side work so community plugins (starting with hopper-edw `/hop/sourceModelData`) can run on authenticated Hop Web, including the OAuth2 demo at hop-web.data-hopper.com. ## What changed ### #8334 — plugin servlet permissions Authenticated Hop Web default-denies unknown `/hop/*` paths. Plugin servlets discovered via `@HopServerServlet` were therefore **403 for every user**, and the authorization filter never called `chain.doFilter()`, so `HopServerServlet` never initialized. - `@HopServerServlet(requiredPermission = "run.execute")` (empty default stays default-deny) - `HopServerEndpointPermissionMapper.register/unregister` overlay; built-in paths always win - `IHopServerPlugin.getRequiredPermissionId()` reads the annotation - Registration on plugin load (Hop Web dispatcher and Jetty) - Eager `<load-on-startup>` for the Server servlet, plus permission scan from `HopWebServletContextListener` after `HopEnvironment.init()` - Longest-prefix dispatch so `/hop/sourceModelData/…` reaches the plugin (null-safe `pathInfo`) ### #8333 — Bearer + JDBC tokens OIDC login is a browser session. JDBC/curl cannot do that. - `HopOidcAuthFilter` / `HopBasicAuthFilter` accept `Authorization: Bearer` - Hop HMAC JWT first (`aud=hop-jdbc`), then IdP ID token via existing JWKS - `GET /hop/jdbcToken` (`file.view`) and **File → Copy JDBC token** issue a ~1 hour token - HMAC secret cached after first VFS read - BASIC Bearer is stateless; an explicit `Authorization` header wins over the form-login session Google OIDC does not issue `client_credentials` for this web client. JDBC against hop-web.data-hopper.com should use **Copy JDBC token** (Bearer), not driver-side OAuth2. addresses #8334 addresses #8333 ------------------------ Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily: - [x] Run `mvn clean install apache-rat:check` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically. - [ ] If you have a group of commits related to the same change, please squash your commits into one and force push your branch using `git rebase -i`. - [x] Mention the appropriate issue in your description (for example: `addresses #123`), if applicable. To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) you have to acknowledge this by using the following check-box. - [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) - [ ] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
