disizwil opened a new issue, #70437: URL: https://github.com/apache/doris/issues/70437
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues. ### Version 4.1.5 (`doris-4.1.5-release-917b20be838`), FE deployed with doris-operator on Kubernetes. ### What's Wrong? With `authentication_type = ldap`, an LDAP user who has **no local Doris account** can log in through the MySQL protocol, but logging in to the FE web UI (`POST /rest/v1/login`) fails with `{"msg":"Internal Error","code":500}`. ``` WARN [RestApiExceptionHandler.unexpectedExceptionHandler():61] unexpected exception java.lang.IllegalStateException at com.google.common.base.Preconditions.checkState(Preconditions.java:499) at org.apache.doris.httpv2.controller.BaseController.checkPassword(BaseController.java:284) at org.apache.doris.httpv2.controller.BaseController.checkWithCookie(BaseController.java:78) at org.apache.doris.httpv2.controller.LoginController.login(LoginController.java:41) ``` ### Root cause (from the 4.1.5 source) 1. `BaseController.checkPassword()` calls `Auth.checkPlainPassword(user, ip, password, currentUser)`. 2. For an LDAP user, this delegates to `LdapManager.checkUserPasswd(..., currentUser)`. After a successful bind, it fills `currentUser` with `Auth.getUserIdentityForLdap()` → `UserManager.getUserIdentityUncheckPasswd()`, which **only returns existing local users**. 3. For an LDAP-only user the list is empty, so `Preconditions.checkState(currentUser.size() == 1)` throws. The MySQL protocol path handles this case by creating a temporary user identity for LDAP users; the HTTP path does not. ### What You Expected? The HTTP login should behave like the MySQL protocol: an LDAP-authenticated user without a local account gets a temporary identity, with privileges coming from their LDAP group roles. ### How to Reproduce? 1. Enable LDAP (`authentication_type = ldap` in `fe.conf` + `ldap.conf`). 2. Use an LDAP user that has no local account (no `CREATE USER`). 3. `mysql -u <user> -p --enable-cleartext-plugin` → login OK. 4. `curl -u <user> -X POST http://<fe_host>:8030/rest/v1/login` → `{"msg":"Internal Error","code":500}`. ### Anything Else? Minor: when a logged-in user lacks `ADMIN_OR_NODE`, the admin pages show *"The login information has expired"* (`BaseController.checkCookie` returns null). A permission error message would be clearer. ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
