sollhui opened a new pull request, #69623:
URL: https://github.com/apache/doris/pull/69623
### What problem does this PR solve?
Two users with LOAD privilege on the same table can currently commit or
abort each other's Stream Load two-phase transactions by transaction ID or
label. The transaction has no persisted creator, so table authorization alone
cannot distinguish them.
Record the authenticated `UserIdentity` when beginning a Stream Load
transaction and persist it with both shared-nothing transaction state and cloud
`TxnInfoPB`. Authenticate the 2PC caller once, check the recorded owner (with
an ADMIN exception), and retain the existing LOAD checks on the transaction's
actual tables. Authentication and ownership checks also run when an abort's
tables have been dropped. Duplicate begin requests cannot return another user's
owned transaction.
Compatibility: `TxnInfoPB.owner` is optional field 24, unused on the
inspected 3.1/4.0/4.1/4.2 branches. Transactions created by older FEs or
internal token-based jobs have no owner and retain the previous authorization
behavior. All FEs must be upgraded before relying on owner enforcement; an old
FE does not enforce it. Existing internal begin callers keep their original
overloads.
### Release note
New user-authenticated Stream Load transactions can be completed through the
two-phase endpoint only by their creator or an ADMIN user, subject to existing
table privileges. Legacy ownerless transactions keep their previous
authorization behavior.
### Check List (For Author)
- Test
- [x] Added unit coverage for commit/abort by ID/label, cross-user and
host-identity rejection, owner recovery after denial, dropped-table abort
authentication, LOAD revocation, ADMIN recovery, legacy transactions, duplicate
begin, and classic/cloud owner persistence and serialization.
- [x] Checkstyle passed for all modified and added Java files.
- [x] Protobuf descriptor generation passed; a legacy-descriptor round
trip preserved the unknown owner field, and legacy records decoded without an
owner.
- [x] Checked the new protobuf field against local `branch-3.1`,
`branch-4.0`, `branch-4.1`, and `branch-4.2` definitions.
- [ ] FE compilation and unit test execution: attempted `./build.sh
--fe` and `run-fe-ut.sh --run ...`; both stop at the environment check because
this machine has JDK 20, while Doris requires JDK 17. Added unit tests have
**not** been executed. This PR is a draft pending that validation.
- Behavior changed:
- [x] Yes: newly owned transactions reject other LOAD users at the
two-phase endpoint.
- Does this need documentation?
- [x] No additional documentation; authorization and upgrade
compatibility are described in the release note above.
### Review notes
Owner is assigned before publishing a new transaction or issuing cloud begin
RPC; existing duplicate transactions are never reassigned. Existing transaction
locking, state transitions, publish visibility and timeout cleanup are
unchanged. The FE RPC check covers both FE redirects and BE HTTP requests.
Cluster-internal token-based jobs remain trusted internal callers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
