CalvinKirs opened a new pull request, #70453: URL: https://github.com/apache/doris/pull/70453
### Background Authentication plugins can supply session roles without creating persistent user-role grants. ### What problem does this PR solve? Issue Number: None Related PR: None PR Type: Bugfix Problem Summary: Users whose permissions come from other authentication plugins can query tables, but `information_schema.schemata`, `tables` and `columns` omit accessible objects because metadata requests lose their session roles. For example, grant `r1` SELECT on `internal.db1.t1`, then log in through an authentication plugin that supplies `r1` as a session role without a persistent user-role grant: ```sql SELECT k FROM db1.t1 LIMIT 1; -- authorized SELECT table_name FROM information_schema.tables WHERE table_schema = 'db1' AND table_name = 't1'; -- incorrectly empty ``` ### Details - **Change map:** Production +210/-48 in 20 files; tests +552/-3 in 3 files. - **Frequency:** Metadata authorization that depends on plugin-supplied session roles. - **Root cause:** RPC identities and authorization adapters retain the account but drop session roles. - **Why existing tests missed it:** Local session checks did not cross serialized metadata callbacks. - **Fix:** Reuse common local/session role resolution and carry a role snapshot through the shared RPC identity. Preserve policy scopes and keep session authority out of persistent grants and durable job owners. - **Other paths and branches:** Update schema/TVF/Flight metadata, process-list requests and FE forwarding on master. The new field is optional; full propagation requires upgraded FE and BE. - **Behavior change:** Accessible metadata now follows the same local and session roles as ordinary queries. ### Testing - Official `run-fe-ut.sh`: 182 tests passed in 16 classes; FE Checkstyle passed. - Covers detached metadata callbacks, local plus session roles, legacy payloads, policy snapshots, job-owner replay and built-in/plugin role boundaries. - Native BE execution and live authentication-plugin integration were not tested. ### Release note Fix missing system metadata for users authorized through authentication-plugin session roles after upgrading FE and BE. ### Check List (For Author) - Behavior changed: Yes (see Details) - Does this need documentation: No - Pre-submission status: Partially verified: native BE execution and live authentication-plugin integration were not tested ### AI Disclosure - Tool: Codex - Generated: Code, tests and PR description - Human review: Pending maintainer review -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
