raghav-reglobe commented on PR #66115: URL: https://github.com/apache/doris/pull/66115#issuecomment-6490219076
Thanks for kicking off the review, @CalvinKirs. Both findings are real and both come from the rebase onto the authentication-integration bindings; fixed in 0f8b49234ac7. **P2 — the immediate domain refresh.** This is the window you asked me to close in the very first round (the new primary visible without the carried secondary, "during exactly the rotation this feature exists to make seamless"). The one-snapshot swap closed it on the account itself, and the periodic resolver copy carried both slots since round 3, but the rebase brought in `UserManager.refreshAuthenticationBinding`, which rebuilds a domain account's resolved-IP entries at once after a password change, an ACCOUNT_LOCK/UNLOCK and a REQUIRE change, and copied the primary alone. Both refresh paths now go through `Password.copyOf`, so a domain account authenticates both slots immediately after RETAIN. The domain unit test no longer forces the periodic refresh before asserting; a second test checks the immediate path. **P1 — a retained password surviving a binding change.** A binding transition now retires the retained secondary instead of carrying it, following the MySQL rule that a change of authentication plugin discards the secondary password. The bound-user guard only refuses native logins while the account is bound, so a password retained before the external-authentication period came back to life once the account returned to native authentication. RETAIN CURRENT PASSWORD is refused across a binding transition in either direction. The decision is derived from the account's state plus the journal's binding, so a follower replays the same outcome; the new tests cover bind/unbind end to end, the RETAIN refusals, and replay. The regression suite is unchanged: binding and domain lifecycles need an integration and a resolvable domain the suite environment does not have, so these cases live in DualPasswordTest. If you would rather see this shaped differently, for example the discard inside `refreshAuthenticationBinding` rather than as a flag on `UserManager.setPassword`, or the RETAIN-on-bound refusal at analysis time instead of in Auth, say so and I will rework it. The PR body is updated. This needs a `/review` and a `run buildall` from your side when you have a moment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
