CalvinKirs opened a new pull request, #70495: URL: https://github.com/apache/doris/pull/70495
### Background Doris creates the built-in root and admin accounts with empty passwords. Operators can configure a hashed initial_root_password or set passwords after startup, but a new cluster currently accepts remote empty-password logins before initialization is completed. ### What problem does this PR solve? Issue Number: None Related PR: None PR Type: Enhancement Problem Summary: Restrict empty-password access to built-in accounts on newly initialized clusters while preserving existing clusters' login behavior. Empty root can authenticate only through a direct loopback MySQL connection and must set a nonempty password before normal SQL; empty admin cannot authenticate as a client until a privileged user sets its password. Internal JOB, MTMV and statistics execution identities remain usable. ### Details - **Change map:** 25 FE production files (+625/-73), four FE test files (+397/-25), nine existing-CI compatibility settings (+25), and two documentation files (+178). No generated files, deployment/tool adapters or new Docker regression suites are included in the aggregate diff. - **Before and after:** New clusters persist a secure-initialization marker with the existing first-FE journal record and preserve it in the authentication image. Marked clusters enforce the built-in-account restrictions across native, certificate, HTTP, forwarded Stream Load and Flight authentication. Local bootstrap sessions have protocol and SQL guards, including prepared statements, and are released only after a successful own-password change. Ordinary users retain their existing password behavior. - **Configs and defaults:** Add immutable allow_empty_password_for_root_admin=false for explicit test compatibility. It does not bypass an existing nonempty password. Keep skip_localhost_auth_check as the existing boolean/default false for explicit local recovery; PROXY protocol connections cannot bootstrap or recover marked clusters. Invalid nonempty initial_root_password values now fail creation before ROLE/VERSION is written, without exposing the configured value. - **Impact on existing users:** Unmarked upgraded clusters retain their authentication policy, including journal-only metadata without an image. Existing CI environments explicitly enable test compatibility. Internal execution contexts do not acquire the client password-reset restriction. Deployment tools relying on remote empty-password built-in accounts need separate adaptation; automated initialization can use the existing hashed initial_root_password. ### Testing - Standard run-fe-ut.sh: **83 tests passed**, with zero failures, errors or skips: DefaultAuthenticatorTest (5), MysqlProtoTest (14), UserAuthenticationBindingTest (21), BootstrapAuthenticationTest (16), and AuthenticatorManagerTest (27). FE main and test sources compiled successfully in this run. - Standalone fe-core Checkstyle: **zero violations**. - Earlier local runtime checks exercised direct/follower password-reset success and rejection, admin-empty JOB/MTMV execution across restart, statistics, audit import and group commit using cached BE 4.1.3. These are historical validation of retained core paths and were not rerun after the final internal API cleanup. That runtime required local be_exec_version=10 and experimental_enable_local_shuffle_planner=false compatibility settings. - Full cloud MS deployments, a real mTLS provider matrix and downgrade round trips were not exercised. COM_CHANGE_USER transport propagation was source-reviewed; no fresh wire exchange is claimed for the final cleanup. ### Notes for Reviewers Start with BootstrapAuthPolicy and BootstrapPasswordGuard, then the first-FE marker journal/replay path in Env. The optional fields use an existing operation code; no Thrift or Protobuf definitions change. Existing authenticated sessions are not revoked by later password changes. Downgrade/checkpoint/re-upgrade preservation of the new marker is not promised. ### Release note New clusters restrict empty-password root to local MySQL password initialization and reject empty-password admin client logins. Set a hashed initial_root_password before the first start for automated deployment, or initialize root locally and enable admin with a password when needed. Existing clusters retain their login behavior. Test environments can explicitly enable allow_empty_password_for_root_admin in FE configuration. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: Yes; repository design and threat-model documentation are updated. Matching quickstart and FE configuration guidance is planned for apache/doris-website. - Pre-submission status: Partially verified: local FE tests and style passed; full cloud MS, real mTLS deployments and downgrade round trips were not exercised. ### AI Disclosure - Tool: Codex (GPT-6). - Generated: FE code, tests, documentation and this PR description. - Human review: Pending maintainer review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
