Anubhav Jindal has posted comments on this change. ( http://gerrit.cloudera.org:8080/24448 )
Change subject: IMPALA-14799: Add oauth_servers support and tests ...................................................................... Patch Set 18: (4 comments) Done http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/rpc/authentication.cc File be/src/rpc/authentication.cc: http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/rpc/authentication.cc@a185 PS18, Line 185: : : : : > I provided direction to delete this flag because it's dangerous since it en We intentionally removed this flag instead of deprecating it because per the new multi-server oauth_servers design and prior review feedback, token signature validation must always be enforced and this override is no longer safe. http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/rpc/authentication.cc@a231 PS18, Line 231: : : : : : > See comment on jwt_validate_signature flag. This flag should also be moved Same reasoning here: we intentionally removed this flag (instead of deprecating it) so signature validation cannot be disabled in the new oauth_servers-based flow. http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/oauth-server-config.h File be/src/util/oauth-server-config.h: http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/oauth-server-config.h@32 PS18, Line 32: 4400 > Curious that why this is 4400 for update frequency, it doesn't seem like a Good catch. 4400 is not an obvious/default-friendly value. I will follow up by aligning this default with the legacy JWKS update frequency behavior for consistency. http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/webserver.cc File be/src/util/webserver.cc: http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/webserver.cc@777 PS18, Line 777: if (use_jwt_) { : if (OAuthTokenAuth(bearer_token, request_info, &response_headers)) { : total_jwt_token_auth_success_->Increment(1); : authenticated = true; : check_csrf_protection = false; : // TODO: cookies are not added, but are not needed right now : } : } : if (!authenticated && use_oauth_) { : if (OAuthTokenAuth(bearer_token, request_info, &response_headers)) { : total_oauth_token_auth_success_->Increment(1); : authenticated = true; : check_csrf_protection = false; : // TODO: cookies are not added, but are not needed right now : } : } : if (!authenticated) { : if (use_jwt_) { : LOG(INFO) << "Invalid JWT token provided"; : total_jwt_token_auth_failure_->Increment(1); : } : if (use_oauth_) { : LOG(INFO) << "Invalid OAuth token provided"; : total_oauth_token_auth_failure_->Increment(1); : } : } > Another question is that if it possible both use_jwt_ and use_oauth_ be tru I kept the current structure intentionally so JWT and OAuth compatibility paths remain explicit and metrics/logging semantics stay clear when one or both modes are enabled. Yes, both can be true by design for migration/backward-compatibility scenarios. We keep separate JWT/OAuth success and failure counters/logs to preserve visibility, so adding a DCHECK to forbid both would break intended compatibility behavior. -- To view, visit http://gerrit.cloudera.org:8080/24448 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ib29ff36600406ba59c10f29d79cc632020f4a3f7 Gerrit-Change-Number: 24448 Gerrit-PatchSet: 18 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]> Gerrit-Comment-Date: Mon, 24 Aug 2026 06:09:41 +0000 Gerrit-HasComments: Yes
