CalvinKirs opened a new pull request, #68923:
URL: https://github.com/apache/doris/pull/68923
### What problem does this PR solve?
Issue Number: N/A
Related PR: N/A
Problem Summary:
A Doris `user@host` entry cannot select a named authentication integration
or constrain the identity accepted from that external system. Add `IDENTIFIED
WITH AUTHENTICATION INTEGRATION integration_name [AS 'identity']` to
CREATE/ALTER USER. The first matching host entry selects its integration, and a
stored AS value must exactly match the authenticated external principal. `ALTER
USER ... IDENTIFIED BY` removes the binding.
- Add default SPI hooks for live DDL identity validation/normalization and
mandatory AS. Persist the normalized identity without resolving plugins during
journal replay or image loading.
- Route bound MySQL logins before credential negotiation, require completed
TLS before requesting clear credentials, and refuse alternative
local/LDAP/plugin/chain/certificate-only/JIT paths for bound accounts. HTTP,
Flight and stream-load password/certificate adapters reject bound accounts
because they do not negotiate integration credentials.
- Reject SET PASSWORD and local password policies for bound accounts,
preserve manual account locks, and prevent dropping integrations with bound
users.
- Expose the integration and normalized identity in SHOW CREATE USER and
mysql.user; add AuthIntegration after RequireSan in SHOW GRANTS.
- Preserve the existing single-operation rule for local-password ALTER.
Bound ALTER carries atomic new-version state plus legacy-readable
lock/TLS/comment/password records.
- Reset alias-only policies when creating independent IP accounts,
immediately synchronize domain TLS requirements, and reject domain binding when
a legacy image cannot distinguish resolved aliases from explicit IP accounts.
- Render AS literals according to SQL mode so SHOW CREATE can recreate
identities containing quotes/backslashes.
**Draft blocker — rollback contract:** the original design requires
unconditional fail-closed rollback without a FE metadata-version bump. Older
framework versions can still admit no-host JIT identities, and some
certificate-only adapters bypass the managed account lock. Random password
hashes and compatibility locks do not close those paths. Keep this PR in draft
until the compatibility policy is resolved and implemented: either reject
unsupported older serving versions with a metadata-version barrier, or
explicitly narrow rollback support to a verified stop-and-reconfigure
procedure. The current implementation does not claim the original unconditional
rollback guarantee.
The authentication SPI version and existing version-policy wording remain
unchanged. No new configuration item or remote artifact loading path is added.
### Release note
Allow a user@host account to exclusively select a named authentication
integration and optional external identity with CREATE/ALTER USER. IDENTIFIED
BY removes the binding. Bound users reject SET PASSWORD and local password
policies while retaining manual ACCOUNT_LOCK/ACCOUNT_UNLOCK. SHOW GRANTS adds
AuthIntegration; mysql.user exposes the integration and identity in plugin and
authentication_string. Rollback support remains a draft design decision.
### Check List (For Author)
- Test
- [x] Regression test
- User-binding and affected role suites passed: 2 suites, 0
failures/skips.
- Expected output generated with run-regression-test.sh and then
verified by a separate comparison run.
- [x] Unit Test
- 83 tests in 12 authentication, SPI, parser and user-DDL classes
passed, with 0 failures/errors/skips.
- Includes exclusivity, TLS-before-credential refusal, strict
principals, persistence/replay, legacy domain ambiguity, explicit IP policy
lifetimes and SQL-mode identity recreation.
- [x] Manual test
- Live SHOW CREATE USER with a backslash identity under
NO_BACKSLASH_ESCAPES.
- [ ] No need to test or manual test. Explain why:
- FE build and Checkstyle passed through build.sh --fe. Validation was
completed on 2026-10-09 for the committed implementation and fixes; no claim of
a full distributed-cluster test or all-path legacy rollback verification.
- Independent review confirmed fixes for legacy combined ALTER, domain alias
provenance/policies, TLS synchronization and literal rendering; the rollback
contract above remains open.
- Behavior changed:
- [ ] No.
- [x] Yes. Explicitly bound accounts use exclusive integration
authentication; SHOW GRANTS gains a column, and ambiguous legacy domain binding
is rejected with remediation guidance.
- Does this need documentation?
- [ ] No.
- [x] Yes. Authentication SPI README updated; SQL reference and upgrade
guidance should accompany the final rollback decision.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Resolve the rollback compatibility contract before marking this PR
ready
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
