github-actions[bot] commented on code in PR #65644:
URL: https://github.com/apache/doris/pull/65644#discussion_r3612536896
##########
fe/fe-core/src/main/java/org/apache/doris/tablefunction/MetadataGenerator.java:
##########
@@ -795,6 +809,38 @@ private static TFetchSchemaTableDataResult
authenticationIntegrationsMetadataRes
return result;
}
+ private static TFetchSchemaTableDataResult
pluginsMetadataResult(TSchemaTableRequestParams params) {
+ if (!params.isSetCurrentUserIdent()) {
+ return errorResult("current user ident is not set.");
+ }
+ UserIdentity currentUserIdentity =
UserIdentity.fromThrift(params.getCurrentUserIdent());
+ TFetchSchemaTableDataResult result = new TFetchSchemaTableDataResult();
+ List<TRow> dataBatch = Lists.newArrayList();
+ result.setDataBatch(dataBatch);
+ result.setStatus(new TStatus(TStatusCode.OK));
+ // The plugin inventory reveals which security/storage components this
cluster
+ // runs; restrict it to ADMIN like SHOW PLUGINS.
+ if
(!Env.getCurrentEnv().getAccessManager().checkGlobalPriv(currentUserIdentity,
PrivPredicate.ADMIN)) {
Review Comment:
[P2] Preserve session-authenticated roles across this metadata RPC.
Authentication-integration role mapping stores granted role names only in the
login `ConnectContext`, and `Auth.getRolesByUserWithLdap()` includes them only
via the current thread-local. Here the FE Thrift worker receives only
`current_user_ident`, so an OIDC/LDAP-mapped role containing ADMIN_PRIV passes
`SHOW PLUGINS` in the SQL session but this check returns false and the table is
silently empty. Please propagate the session-authenticated roles end to end
(including FE-forwarded queries) before checking ADMIN, and add a positive
mapped-ADMIN test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
