danhuawang opened a new issue, #11433: URL: https://github.com/apache/gravitino/issues/11433
### Version main branch ### Describe what's wrong When `gravitino.authorization.serviceAdmins = admin,service-account-postman-client` is configured, only the first admin (`admin`) is initialized as an IDP user during startup. The second service admin (`service-account-postman-client`) is NOT created in the IDP user store. Expected behavior: All users listed in `gravitino.authorization.serviceAdmins` should be created as IDP users during initialization when `GRAVITINO_INITIAL_ADMIN_PASSWORD` is set. Actual behavior: Only `admin` is created. `service-account-postman-client` does not exist in the IDP user store, causing authentication failures (401) and "IdP user not found" errors (404) when attempting to use or manage it. ``` curl -u admin:Passw0rd-Admin12 http://192.168.97.2:30090/api/idp/users/service-account-postman-client {"code":1003,"type":"NotFoundException","message":"Failed to operate built-in IdP user [service-account-postman-client] operation [GET], reason [IdP user not found: service-account-postman-client]","stack":["org.apache.gravitino.exceptions.NotFoundException: IdP user not found: service-account-postman-client","\tat org.apache.gravitino.idp.storage.service.IdpUserMetaService.getIdpUser(IdpUserMetaService.java:70)","\tat org.apache.gravitino.idp.IdpUserGroupManager.getUser(IdpUserGroupManager.java:150)","\tat org.apache.gravitino.idp.web.rest.IdpUserOperations.lambda$getUser$0(IdpUserOperations.java:66)","\tat java.base/java.security.AccessController.doPrivileged(AccessController.java:712)","\tat java.base/javax.security.auth.Subject.doAs(Subject.java:439)","\tat org.apache.gravitino.utils.PrincipalUtils.doAs(PrincipalUtils.java:53)","\tat org.apache.gravitino.idp.web.IdpRESTUtils.doAs(IdpRESTUtils.java:53)","\tat org.apache.gravitino.idp.web.IdpRESTUtils.doAs(IdpRESTUtils.java:64) ","\tat org.apache.gravitino.idp.web.rest.IdpUserOperations.getUser(IdpUserOperations.java:64)","\tat jdk.internal.reflect.GeneratedMethodAccessor297.invoke(Unknown Source)","\tat java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)","\t ``` ### Error message and/or stacktrace When authenticating as `service-account-postman-client`: ``` HTTP 401 Unauthorized ``` When admin tries to change `service-account-postman-client`'s password via `PUT /api/idp/users/service-account-postman-client`: ```json { "code": 1003, "type": "NotFoundException", "message": "Failed to operate built-in IdP user [service-account-postman-client] operation [UPDATE], reason [IdP user not found: service-account-postman-client]" } ``` Stack trace: ``` org.apache.gravitino.exceptions.NotFoundException: IdP user not found: service-account-postman-client at org.apache.gravitino.idp.storage.service.IdpUserMetaService.lambda$updateIdpUserPassword$8(IdpUserMetaService.java:135) at org.apache.gravitino.storage.relational.utils.SessionUtils.doWithCommitAndFetchResult(SessionUtils.java:56) at org.apache.gravitino.idp.storage.service.IdpUserMetaService.updateIdpUserPassword(IdpUserMetaService.java:130) at org.apache.gravitino.idp.IdpUserGroupManager.changePassword(IdpUserGroupManager.java:176) at org.apache.gravitino.idp.web.rest.IdpUserOperations.lambda$changePassword$2(IdpUserOperations.java:100) ``` ### How to reproduce 1. Configure Gravitino with: ```properties gravitino.authorization.serviceAdmins = admin,service-account-postman-client ``` 2. Set environment variable: ```shell export GRAVITINO_INITIAL_ADMIN_PASSWORD='Passw0rd-Admin12' ``` 3. Enable the IDP REST extension: ```properties gravitino.server.rest.extensionPackages = org.apache.gravitino.idp.web.rest.feature ``` 4. Start Gravitino server. 5. Verify `admin` exists: ```shell curl -u admin:Passw0rd-Admin12 http://localhost:30090/api/idp/users/admin # Returns 200 ``` 6. Verify `service-account-postman-client` does NOT exist: ```shell curl -u admin:Passw0rd-Admin12 http://localhost:30090/api/idp/users/service-account-postman-client # Returns 404 ``` ### Additional context - The initialization logic should iterate over all entries in `gravitino.authorization.serviceAdmins` and create each one as an IDP user if it does not already exist. - Backend: PostgreSQL (deploy mode). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
