Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
CalvinKirs merged PR #67444: URL: https://github.com/apache/doris/pull/67444 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5520545890 # BE UT Coverage Report Increment line coverage ` ` :tada: [Increment coverage report](http://coverage.selectdb-in.cc/coverage/124e2f47b0e656d6400c00f0d47368ff97cf4449_124e2f47b0e656d6400c00f0d47368ff97cf4449/increment_report/index.html) [Complete coverage report](http://coverage.selectdb-in.cc/coverage/124e2f47b0e656d6400c00f0d47368ff97cf4449_124e2f47b0e656d6400c00f0d47368ff97cf4449/report/index.html) | Category | Coverage | |---|| | Function Coverage | 62.95% (29573/46980) | | Line Coverage | 47.99% (310090/646183) | | Region Coverage | 43.57% (250411/574709) | | Branch Coverage | 45.09% (116516/258380) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5519957262 ClickBench: Total hot run time: 14.55 s ``` machine: 'aliyun_ecs.c7a.8xlarge_32C64G' scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools ClickBench test result on commit 124e2f47b0e656d6400c00f0d47368ff97cf4449, data reload: false query1 0.000.000.00 query2 0.080.040.04 query3 0.250.110.11 query4 1.600.100.09 query5 0.170.160.15 query6 1.250.670.68 query7 0.030.010.00 query8 0.050.030.02 query9 0.290.220.21 query10 0.360.350.34 query11 0.160.120.12 query12 0.140.120.12 query13 0.300.300.32 query14 0.440.450.44 query15 0.360.340.33 query16 0.210.220.24 query17 0.650.670.67 query18 0.190.180.17 query19 1.141.161.11 query20 0.010.020.02 query21 15.43 0.150.12 query22 5.100.050.04 query23 16.18 0.240.10 query24 2.980.310.30 query25 0.090.060.03 query26 0.790.170.12 query27 0.050.030.02 query28 3.670.570.27 query29 12.45 3.152.54 query30 0.250.120.13 query31 2.750.370.17 query32 3.520.320.23 query33 1.441.381.61 query34 15.39 2.161.75 query35 1.721.711.71 query36 0.450.300.28 query37 0.070.040.04 query38 0.050.040.04 query39 0.020.020.03 query40 0.120.080.07 query41 0.090.020.02 query42 0.040.020.02 query43 0.030.030.03 Total cold run time: 90.36 s Total hot run time: 14.55 s ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5519924631 TPC-DS: Total hot run time: 81801 ms ``` machine: 'aliyun_ecs.c7a.8xlarge_32C64G' scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools TPC-DS sf100 test result on commit 124e2f47b0e656d6400c00f0d47368ff97cf4449, data reload: false query5 4261422 340 340 query6 406 139 127 127 query7 4905404 254 254 query8 318 126 113 113 query9 8673287828972878 query10 388 231 192 192 query11 53671034933 933 query12 122 72 71 71 query13 1209455 345 345 query14 6089219520692069 query14_11979196319471947 query15 176 119 117 117 query16 949 391 363 363 query17 973 461 370 370 query18 2380333 242 242 query19 168 139 108 108 query20 85 69 75 69 query21 203 103 86 86 query22 5386533854215338 query23 6701622858035803 query23_16109602561036025 query24 72341079782 782 query24_1825 801 801 801 query25 417 275 233 233 query26 1224241 124 124 query27 2783415 265 265 query28 4621149115031491 query29 923 434 327 327 query30 241 155 127 127 query31 841 396 326 326 query32 125 71 71 71 query33 450 220 162 162 query34 1025822 477 477 query35 392 395 335 335 query36 569 557 515 515 query37 118 78 70 70 query38 1013836 807 807 query39 490 492 486 486 query39_1466 457 469 457 query40 207 89 75 75 query41 54 55 52 52 query42 75 71 76 71 query43 234 237 208 208 query44 1061550 564 550 query45 120 111 103 103 query46 754 840 529 529 query47 762 752 701 701 query48 325 314 222 222 query49 552 249 182 182 query50 698 265 189 189 query51 8137810882478108 query52 68 73 59 59 query53 192 201 155 155 query54 234 171 185 171 query55 76 61 57 57 query56 209 192 169 169 query57 703 650 675 650 query58 225 177 166 166 query59 1206124111081108 query60 249 185 177 177 query61 139 149 157 149 query62 359 210 184 184 query63 167 144 145 144 query64 2702740 551 551 query65 1598161915811581 query66 1825254 204 204 query67 10006 946195859461 query68 30171127754 754 query69 344 227 197 197 query70 681 624 646 624 query71 247 165 164 164 query72 2378171216081608 query73 645 614 366 366 query74 2008126011431143 query75 11851095966 966 query76 2328724 579 579 query77 250 245 209 209 query78 3921372132003200 query79 2750859 596 596 query80 1626323 292 292 query81 495 153 142 142 query82 618 128 110 110 query83 286 207 189 189 query84 264 116 92 92 query85 865 357 305 305 query86 403 183 175 175 query87 1026994 896 896 query88 2773211520992099 query89 284 191 172 172 query90 1929131 128 128 query91 134 125 99 99 query92 80 68 70 68 query93 18931088671 671 query94 649 248 223 223 query95 510 344 229 229 query96 841 572 273 273 query97 10601023995 995 query98 169 139 136 136 query99 439 337 309 309 Total cold run time: 179051 ms Total hot run time: 81801 ms ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5519876170 TPC-H: Total hot run time: 16722 ms ``` machine: 'aliyun_ecs.c7a.8xlarge_32C64G' scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools Tpch sf100 test result on commit 124e2f47b0e656d6400c00f0d47368ff97cf4449, data reload: false -- Round 1 -- q1 17269 307830233023 q2 2092256 213 213 q3 10157 873 530 530 q4 4673253 209 209 q5 7718558 392 392 q6 140 114 93 93 q7 533 504 381 381 q8 9294853 915 853 q9 3443238523782378 q10 6474867 733 733 q11 408 200 188 188 q12 611 258 201 201 q13 18123 152211681168 q14 158 152 140 140 q15 q16 440 397 364 364 q17 1417869 816 816 q18 3075224622252225 q19 1207941 670 670 q20 391 303 204 204 q21 5262170918661709 q22 331 271 232 232 Total cold run time: 93216 ms Total hot run time: 16722 ms - Round 2, with runtime_filter_mode=off - q1 33993336 q2 510 395 359 359 q3 2196227021332133 q4 11901168882 882 q5 2162211021232110 q6 166 131 89 89 q7 1032930 830 830 q8 1592140813931393 q9 3124309930863086 q10 1826180516011601 q11 356 275 249 249 q12 454 427 333 333 q13 1472150211481148 q14 168 178 154 154 q15 q16 399 394 361 361 q17 3575333131713171 q18 4775440346974403 q19 879 841 833 833 q20 1156992 838 838 q21 3846308833223088 q22 391 352 315 315 Total cold run time: 34668 ms Total hot run time: 30709 ms ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
CalvinKirs commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5519077679 run buildall -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
CalvinKirs commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5510853573 run buildall -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5513542870 ClickBench: Total hot run time: 14.58 s ``` machine: 'aliyun_ecs.c7a.8xlarge_32C64G' scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools ClickBench test result on commit 43cb8a5c39da572ca8137013977c2b484051b583, data reload: false query1 0.010.010.00 query2 0.070.040.04 query3 0.250.100.10 query4 1.610.100.09 query5 0.170.150.16 query6 1.260.670.68 query7 0.030.010.00 query8 0.050.030.03 query9 0.280.220.21 query10 0.350.360.34 query11 0.160.110.11 query12 0.150.120.12 query13 0.320.320.30 query14 0.450.450.45 query15 0.360.340.36 query16 0.220.230.21 query17 0.730.670.67 query18 0.180.160.18 query19 1.211.201.07 query20 0.020.010.01 query21 15.46 0.160.12 query22 5.050.040.04 query23 16.17 0.240.09 query24 3.010.310.26 query25 0.110.040.04 query26 0.770.160.11 query27 0.040.030.03 query28 3.740.580.29 query29 12.48 3.182.56 query30 0.270.100.12 query31 2.760.370.17 query32 3.510.300.24 query33 1.531.461.52 query34 15.37 2.261.77 query35 1.781.721.72 query36 0.470.290.28 query37 0.070.040.04 query38 0.040.030.03 query39 0.030.030.02 query40 0.120.080.08 query41 0.080.030.02 query42 0.040.020.02 query43 0.040.020.03 Total cold run time: 90.82 s Total hot run time: 14.58 s ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5513487700 TPC-DS: Total hot run time: 81853 ms ``` machine: 'aliyun_ecs.c7a.8xlarge_32C64G' scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools TPC-DS sf100 test result on commit 43cb8a5c39da572ca8137013977c2b484051b583, data reload: false query5 4247413 335 335 query6 384 136 126 126 query7 4955426 244 244 query8 289 128 123 123 query9 8683289828972897 query10 374 219 177 177 query11 53791035902 902 query12 116 68 72 68 query13 1186476 310 310 query14 6179218520702070 query14_11988199619491949 query15 177 122 117 117 query16 919 362 353 353 query17 809 465 372 372 query18 2344325 260 260 query19 170 145 112 112 query20 71 72 73 72 query21 205 103 88 88 query22 5319548652735273 query23 6697625459195919 query23_16083598658695869 query24 73371084770 770 query24_1766 746 773 746 query25 421 279 242 242 query26 1225233 125 125 query27 2796410 260 260 query28 4705149615041496 query29 899 432 340 340 query30 240 157 130 130 query31 835 391 320 320 query32 125 70 76 70 query33 474 226 177 177 query34 1008813 504 504 query35 401 403 335 335 query36 571 568 531 531 query37 120 84 74 74 query38 985 836 833 833 query39 495 471 473 471 query39_1473 447 513 447 query40 209 90 74 74 query41 54 51 52 51 query42 75 77 71 71 query43 240 241 209 209 query44 1023540 539 539 query45 108 109 102 102 query46 783 825 511 511 query47 770 764 695 695 query48 305 313 235 235 query49 531 237 189 189 query50 774 258 188 188 query51 8147819481748174 query52 76 67 63 63 query53 197 204 151 151 query54 218 169 158 158 query55 85 60 58 58 query56 182 161 165 161 query57 668 721 652 652 query58 202 164 167 164 query59 1216119911161116 query60 255 177 173 173 query61 137 164 121 121 query62 357 208 177 177 query63 170 140 138 138 query64 2706686 656 656 query65 1631157916241579 query66 1886285 230 230 query67 10064 992995559555 query68 30641232771 771 query69 352 230 200 200 query70 662 599 589 589 query71 250 176 161 161 query72 2326173015811581 query73 648 579 341 341 query74 2009120211631163 query75 11651113956 956 query76 2380735 533 533 query77 268 252 215 215 query78 4002366331823182 query79 2734810 602 602 query80 1554322 280 280 query81 514 156 134 134 query82 654 125 100 100 query83 292 215 196 196 query84 311 112 91 91 query85 804 362 304 304 query86 468 172 174 172 query87 1038965 900 900 query88 2821211820972097 query89 286 196 176 176 query90 2020128 131 128 query91 132 121 97 97 query92 89 62 72 62 query93 16091062721 721 query94 621 245 229 229 query95 513 245 293 245 query96 828 599 255 255 query97 1109103410431034 query98 157 138 131 131 query99 414 354 314 314 Total cold run time: 179042 ms Total hot run time: 81853 ms ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5513407218 TPC-H: Total hot run time: 16825 ms ``` machine: 'aliyun_ecs.c7a.8xlarge_32C64G' scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools Tpch sf100 test result on commit 43cb8a5c39da572ca8137013977c2b484051b583, data reload: false -- Round 1 -- q1 17566 303930163016 q2 2086248 227 227 q3 10259 895 500 500 q4 4675249 205 205 q5 7675562 396 396 q6 137 113 93 93 q7 525 523 390 390 q8 9230890 926 890 q9 3426244923842384 q10 6533835 748 748 q11 388 196 183 183 q12 613 261 204 204 q13 18123 152011531153 q14 161 149 138 138 q15 q16 427 392 365 365 q17 1347901 779 779 q18 3092226622202220 q19 1146912 804 804 q20 371 291 209 209 q21 5259169718071697 q22 335 269 224 224 Total cold run time: 93374 ms Total hot run time: 16825 ms - Round 2, with runtime_filter_mode=off - q1 3406332933493329 q2 522 399 370 370 q3 2186240621582158 q4 11881155893 893 q5 2189211321112111 q6 163 122 87 87 q7 1025931 854 854 q8 1609140714081407 q9 3127311430963096 q10 1829181216091609 q11 355 272 252 252 q12 454 433 346 346 q13 1483152511521152 q14 179 172 162 162 q15 q16 397 389 351 351 q17 3646329232063206 q18 4775437547024375 q19 878 817 931 817 q20 1018988 820 820 q21 3817308132933081 q22 397 360 311 311 Total cold run time: 34643 ms Total hot run time: 30787 ms ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5513300942 # BE Regression && UT Coverage Report Increment line coverage `100% (0/0)` :tada: [Increment coverage report](http://coverage.selectdb-in.cc/coverage/67444_43cb8a5c39da572ca8137013977c2b484051b583_merge/increment_report/index.html) [Complete coverage report](http://coverage.selectdb-in.cc/coverage/67444_43cb8a5c39da572ca8137013977c2b484051b583_merge/report/index.html) | Category | Coverage | |---|| | Function Coverage | 76.03% (34594/45503) | | Line Coverage | 61.07% (390101/638812) | | Region Coverage | 57.05% (326610/572518) | | Branch Coverage | 57.96% (149332/257641) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5512924327 # BE UT Coverage Report Increment line coverage ` ` :tada: [Increment coverage report](http://coverage.selectdb-in.cc/coverage/43cb8a5c39da572ca8137013977c2b484051b583_43cb8a5c39da572ca8137013977c2b484051b583/increment_report/index.html) [Complete coverage report](http://coverage.selectdb-in.cc/coverage/43cb8a5c39da572ca8137013977c2b484051b583_43cb8a5c39da572ca8137013977c2b484051b583/report/index.html) | Category | Coverage | |---|| | Function Coverage | 62.95% (29573/46980) | | Line Coverage | 47.99% (310092/646183) | | Region Coverage | 43.57% (250428/574709) | | Branch Coverage | 45.10% (116525/258380) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5512165968 # FE UT Coverage Report Increment line coverage ` 100.00% (11/11)` :tada: [Increment coverage report](http://coverage.selectdb-in.cc/coverage/67444_43cb8a5c39da572ca8137013977c2b484051b583/fe_increment_report/index.html) [Complete coverage report](http://coverage.selectdb-in.cc/coverage/67444_43cb8a5c39da572ca8137013977c2b484051b583/fe_report/index.html) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5511217565 # Cloud UT Coverage Report Increment line coverage ` ` :tada: [Increment coverage report](http://coverage.selectdb-in.cc/coverage/43cb8a5c39da572ca8137013977c2b484051b583_43cb8a5c39da572ca8137013977c2b484051b583_cloud/increment_report/index.html) [Complete coverage report](http://coverage.selectdb-in.cc/coverage/43cb8a5c39da572ca8137013977c2b484051b583_43cb8a5c39da572ca8137013977c2b484051b583_cloud/report/index.html) | Category | Coverage | |---|| | Function Coverage | 77.71% (2053/2642) | | Line Coverage | 65.65% (37473/57080) | | Region Coverage | 52.83% (34900/66057) | | Branch Coverage | 56.30% (11228/19942) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5509282956 # BE UT Coverage Report Increment line coverage ` ` :tada: [Increment coverage report](http://coverage.selectdb-in.cc/coverage/aac29f05465224520b9afa13c6eb2df073a15752_aac29f05465224520b9afa13c6eb2df073a15752/increment_report/index.html) [Complete coverage report](http://coverage.selectdb-in.cc/coverage/aac29f05465224520b9afa13c6eb2df073a15752_aac29f05465224520b9afa13c6eb2df073a15752/report/index.html) | Category | Coverage | |---|| | Function Coverage | 62.96% (29577/46980) | | Line Coverage | 48.02% (310290/646183) | | Region Coverage | 43.61% (250644/574709) | | Branch Coverage | 45.11% (116562/258380) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
github-actions[bot] commented on code in PR #67444:
URL: https://github.com/apache/doris/pull/67444#discussion_r3913082084
##
gensrc/thrift/FrontendService.thrift:
##
@@ -1623,6 +1623,7 @@ struct TShowProcessListResult {
}
struct TShowUserRequest {
+1: optional Types.TUserIdentity current_user_ident // to filter rows by
the requesting user's privileges
Review Comment:
[P1] Preserve session-mapped roles across this callback. Authentication
integrations keep their granted roles only in the originating ConnectContext,
and Auth.getRolesByUserWithLdap consults that set only on the session thread.
The BE callback reaches a Thrift worker with just this identity, so an OIDC/JIT
user whose mapped role has global ADMIN_PRIV or GRANT_PRIV is evaluated as a
normal user and cannot see all rows. Please carry the immutable
authenticated-role set (or a trusted precomputed authorization decision)
through the plan/request and cover a mapped-role administrator.
##
fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Auth.java:
##
@@ -2098,16 +2100,29 @@ public String getDefaultCloudCluster(String user) {
// == END CLOUD ==
// for mysql.user table
-public List> getAllUserInfo() {
+public List> getAllUserInfo(UserIdentity currentUser) {
+// Only role administrators (ADMIN_PRIV or GRANT_PRIV) may see every
account. A
+// non-privileged user may only see their own account, so that
mysql.user does not
+// leak the cluster's account list and privilege topology to arbitrary
users.
+boolean canSeeAll = currentUser != null
+&&
Env.getCurrentEnv().getAccessManager().checkGlobalPriv(currentUser,
PrivPredicate.GRANT);
List> userInfos = Lists.newArrayList();
readLock();
try {
Map> nameToUsers = userManager.getNameToUsers();
for (List users : nameToUsers.values()) {
for (User user : users) {
if (!user.isSetByDomainResolver()) {
-List userInfo =
Lists.newArrayList(Collections.nCopies(32, ""));
UserIdentity userIdent = user.getUserIdentity();
+// Match by user name only (host intentionally
ignored): the account name is
+// the identity subject, so a caller sees every
same-named entry regardless of
+// its host pattern. Password material is masked
below, so nothing sensitive
+// leaks even across host variants of the same name.
+if (!canSeeAll && (currentUser == null ||
!userIdent.getQualifiedUser()
Review Comment:
[P1] Scope the self case to the exact authenticated account. Doris stores
multiple User entries for one name when their hosts differ, and
ConnectContext.currentUserIdentity is the exact user@host entry that matched
login. With a restricted u@hostA and a separate privileged u@hostB, this
username-only comparison admits both rows and exposes host, global privilege
flags, and password-policy state from the other account. Please compare the
complete UserIdentity here and add a same-name/different-host regression.
##
fe/fe-core/src/test/java/org/apache/doris/service/FrontendServiceImplTest.java:
##
@@ -583,11 +583,44 @@ public void fetchSchemaTableData() throws Exception {
}
@Test
-public void testShowUser() {
+public void testShowUser() throws Exception {
Review Comment:
[P1] Remove the now-unused TShowUserResult import. This rewritten test no
longer declares a TShowUserResult, and the CheckStyle job on this exact head
fails at line 69 with UnusedImports. Please remove that import so the required
FE style gate passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5507918631 # Cloud UT Coverage Report Increment line coverage ` ` :tada: [Increment coverage report](http://coverage.selectdb-in.cc/coverage/aac29f05465224520b9afa13c6eb2df073a15752_aac29f05465224520b9afa13c6eb2df073a15752_cloud/increment_report/index.html) [Complete coverage report](http://coverage.selectdb-in.cc/coverage/aac29f05465224520b9afa13c6eb2df073a15752_aac29f05465224520b9afa13c6eb2df073a15752_cloud/report/index.html) | Category | Coverage | |---|| | Function Coverage | 77.71% (2053/2642) | | Line Coverage | 65.61% (37448/57080) | | Region Coverage | 52.82% (34893/66057) | | Branch Coverage | 56.29% (11226/19942) | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
CalvinKirs commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5507540569 /review -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
CalvinKirs commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5507539295 run buildall -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] [improvement](auth) Scope mysql.user rows to the caller and mask password columns [doris]
hello-stephen commented on PR #67444: URL: https://github.com/apache/doris/pull/67444#issuecomment-5507415863 Thank you for your contribution to Apache Doris. Don't know what should be done next? See [How to process your PR](https://cwiki.apache.org/confluence/display/DORIS/How+to+process+your+PR). Please clearly describe your PR: 1. What problem was fixed (it's best to include specific error reporting information). How it was fixed. 2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be. 3. What features were added. Why was this function added? 4. Which code was refactored and why was this part of the code refactored? 5. Which functions were optimized and what is the difference before and after the optimization? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
