Yida Wu has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24448 )
Change subject: IMPALA-14799: Add oauth_servers support and tests ...................................................................... IMPALA-14799: Add oauth_servers support and tests Introduce --oauth_servers to configure multiple JWT/OAuth identity providers, migrate legacy jwks_* and oauth_* flags with deprecation warnings, and verify tokens across configured JWKS sources. Consolidate bearer-token verification through OAuthServersManager, enforce signature validation for matched servers, add RFC6750 bearer auth response headers, and apply follow-up review cleanups in JWT helper internals. Testing: - Linux build: ninja impalad oauth-server-config-test oauth-servers-manager-test jwt-util-test - OAuthServerConfigTest (13/13 passing) - OAuthServersManagerTest (5/5 passing) - JwtUtilTest (23/23 passing) - org.apache.impala.customcluster.JwtHttpTest (8/8 passing) - tests/custom_cluster/test_shell_oauth_servers_auth.py (3/3 passing) - org.apache.impala.customcluster.LdapHS2Test #testHiveserver2JwtAndOAuthAuth (1/1 passing) Change-Id: Ib29ff36600406ba59c10f29d79cc632020f4a3f7 Assisted-by: GPT-5.3 (Cursor) Reviewed-on: http://gerrit.cloudera.org:8080/24448 Tested-by: Impala Public Jenkins <[email protected]> Reviewed-by: Yida Wu <[email protected]> --- M SECURITY.md M be/src/rpc/authentication.cc M be/src/runtime/exec-env.cc M be/src/runtime/exec-env.h M be/src/service/impala-server.cc M be/src/util/CMakeLists.txt M be/src/util/jwt-util-internal.h M be/src/util/jwt-util.cc M be/src/util/jwt-util.h A be/src/util/oauth-server-config-test.cc A be/src/util/oauth-server-config.cc A be/src/util/oauth-server-config.h A be/src/util/oauth-servers-manager-test.cc A be/src/util/oauth-servers-manager.cc A be/src/util/oauth-servers-manager.h M be/src/util/webserver.cc M be/src/util/webserver.h M fe/src/test/java/org/apache/impala/customcluster/JwtHttpTest.java M fe/src/test/java/org/apache/impala/customcluster/JwtWebserverTest.java M fe/src/test/java/org/apache/impala/customcluster/LdapHS2Test.java M fe/src/test/java/org/apache/impala/customcluster/LdapWebserverTest.java M tests/custom_cluster/test_shell_jwt_auth.py M tests/custom_cluster/test_shell_oauth_auth.py A tests/custom_cluster/test_shell_oauth_servers_auth.py 24 files changed, 1,254 insertions(+), 327 deletions(-) Approvals: Impala Public Jenkins: Verified Yida Wu: Looks good to me, approved -- To view, visit http://gerrit.cloudera.org:8080/24448 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: Ib29ff36600406ba59c10f29d79cc632020f4a3f7 Gerrit-Change-Number: 24448 Gerrit-PatchSet: 30 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]>
