roryqi commented on code in PR #11281: URL: https://github.com/apache/gravitino/pull/11281#discussion_r3317169933
########## design-docs/gravitino-local-authentication.md: ########## @@ -414,116 +392,44 @@ credentials are otherwise exposed on the wire. ## 8. Configuration -### 8.1 Authenticator Selection - -Add `basic` to the configurable values of `gravitino.authenticators`. - -| Key | New Value | Default | Optional Values | -|---|---|---|---| -| `gravitino.authenticators` | `basic` | `simple` | `simple`, `oauth`, `kerberos`, `basic` | +### 8.1 Built-in IDP settings -This should follow Gravitino's existing multi-authenticator behavior: multiple authenticators are -comma-separated, and if a request is supported by multiple authenticators simultaneously, the first -matching authenticator wins. +| Key | Value | Required when using built-in IDP | +|-----|--------|----------------------------------| +| `gravitino.server.rest.extensionPackages` | `org.apache.gravitino.idp.web.rest.feature` | Yes | +| `gravitino.authorization.serviceAdmins` | Comma-separated service admin usernames | Yes | -The local authentication management capability is enabled only when `basic` is included in -`gravitino.authenticators`. If `basic` is not enabled, Gravitino should not allow local authentication -management APIs to be used. +List `org.apache.gravitino.idp.web.rest.feature` in `gravitino.server.rest.extensionPackages` so +Jersey registers `/api/idp/*` management APIs. Callers must use HTTP Basic with a username in +`gravitino.authorization.serviceAdmins` and a password stored in `idp_user_meta`. Review Comment: Why do we tell user which table we used? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
