This is an automated email from the ASF dual-hosted git repository.
jerryshao pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/branch-1.3 by this push:
new dff5890fe5 [Cherry-pick to branch-1.3] [#11434] fix(idp): Validate
name length at API layer before DB persist (#11493) (#11504)
dff5890fe5 is described below
commit dff5890fe5c163dec97b887f450388af5109a67a
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue Jun 9 09:20:10 2026 +0800
[Cherry-pick to branch-1.3] [#11434] fix(idp): Validate name length at API
layer before DB persist (#11493) (#11504)
**Cherry-pick Information:**
- Original commit: d42868abb2832f10d3fac879b4a2974b41cf4c0f
- Target branch: `branch-1.3`
- Status: ✅ Clean cherry-pick (no conflicts)
Co-authored-by: MaSai <[email protected]>
---
docs/open-api/idp/idp.yaml | 277 +++++++++++++++------
.../idp/basic/IdpCredentialValidator.java | 16 ++
.../idp/dto/requests/AddGroupRequest.java | 6 +-
.../org/apache/gravitino/idp/web/IdpRESTUtils.java | 5 +-
.../idp/dto/requests/TestAddGroupRequest.java | 2 +
.../idp/dto/requests/TestAddUserRequest.java | 3 +
.../idp/integration/test/IdpRESTApiIT.java | 8 +
7 files changed, 237 insertions(+), 80 deletions(-)
diff --git a/docs/open-api/idp/idp.yaml b/docs/open-api/idp/idp.yaml
index bc5e211ea9..0aea6d75db 100644
--- a/docs/open-api/idp/idp.yaml
+++ b/docs/open-api/idp/idp.yaml
@@ -24,9 +24,7 @@ paths:
tags:
- IDP
summary: Add built-in IDP user
- description: >
- Creates a built-in IDP user with the given username and password.
- Requires the `basic` authenticator and the `idp-basic` plugin to be
enabled.
+ description: Creates a built-in IDP user with the given username and
password.
operationId: addIdpUser
requestBody:
required: true
@@ -45,12 +43,17 @@ paths:
schema:
$ref: "#/components/schemas/IdpUserResponse"
examples:
- IdpUserResponse:
- $ref: "#/components/examples/IdpUserResponse"
+ IdpUserAddResponse:
+ $ref: "#/components/examples/IdpUserAddResponse"
"400":
- $ref: "../openapi.yaml#/components/responses/BadRequestErrorResponse"
- "403":
- $ref: "#/components/responses/IdpForbiddenErrorResponse"
+ description: Bad Request - The request body is invalid
+ content:
+ application/vnd.gravitino.v1+json:
+ schema:
+ $ref: "../openapi.yaml#/components/schemas/ErrorModel"
+ examples:
+ IllegalArgumentException:
+ $ref:
"#/components/examples/IdpAddUserIllegalArgumentException"
"409":
description: Conflict - The built-in IDP user already exists
content:
@@ -60,6 +63,8 @@ paths:
examples:
AlreadyExistsException:
$ref: "#/components/examples/IdpAlreadyExistsException"
+ "403":
+ $ref: "#/components/responses/IdpForbiddenErrorResponse"
"5xx":
$ref: "../openapi.yaml#/components/responses/ServerErrorResponse"
@@ -71,7 +76,7 @@ paths:
tags:
- IDP
summary: Get built-in IDP user
- description: Returns the specified built-in IDP user, including group
membership.
+ description: Returns the specified built-in IDP user, including group
membership (empty if none; the example shows a user who already belongs to
groups).
operationId: getIdpUser
responses:
"200":
@@ -81,8 +86,8 @@ paths:
schema:
$ref: "#/components/schemas/IdpUserResponse"
examples:
- IdpUserResponse:
- $ref: "#/components/examples/IdpUserResponse"
+ IdpUserGetResponse:
+ $ref: "#/components/examples/IdpUserGetResponse"
"403":
$ref: "#/components/responses/IdpForbiddenErrorResponse"
"404":
@@ -101,7 +106,7 @@ paths:
tags:
- IDP
summary: Change built-in IDP user password
- description: Updates the password of the specified built-in IDP user.
+ description: Updates the password of the specified built-in IDP user and
returns the user object with unchanged group membership.
operationId: changeIdpUserPassword
requestBody:
required: true
@@ -120,10 +125,17 @@ paths:
schema:
$ref: "#/components/schemas/IdpUserResponse"
examples:
- IdpUserResponse:
- $ref: "#/components/examples/IdpUserResponse"
+ IdpUserUpdateResponse:
+ $ref: "#/components/examples/IdpUserUpdateResponse"
"400":
- $ref: "../openapi.yaml#/components/responses/BadRequestErrorResponse"
+ description: Bad Request - The request body is invalid
+ content:
+ application/vnd.gravitino.v1+json:
+ schema:
+ $ref: "../openapi.yaml#/components/schemas/ErrorModel"
+ examples:
+ IllegalArgumentException:
+ $ref:
"#/components/examples/IdpChangePasswordIllegalArgumentException"
"403":
$ref: "#/components/responses/IdpForbiddenErrorResponse"
"404":
@@ -134,7 +146,7 @@ paths:
$ref: "../openapi.yaml#/components/schemas/ErrorModel"
examples:
NotFoundException:
- $ref: "#/components/examples/IdpNotFoundException"
+ $ref: "#/components/examples/IdpUserUpdateNotFoundException"
"5xx":
$ref: "../openapi.yaml#/components/responses/ServerErrorResponse"
@@ -142,23 +154,13 @@ paths:
tags:
- IDP
summary: Remove built-in IDP user
+ description: Removes the specified built-in IDP user.
operationId: removeIdpUser
responses:
"200":
$ref: "../openapi.yaml#/components/responses/RemoveResponse"
- "400":
- $ref: "../openapi.yaml#/components/responses/BadRequestErrorResponse"
"403":
$ref: "#/components/responses/IdpForbiddenErrorResponse"
- "404":
- description: Not Found - The specified built-in IDP user does not
exist
- content:
- application/vnd.gravitino.v1+json:
- schema:
- $ref: "../openapi.yaml#/components/schemas/ErrorModel"
- examples:
- NotFoundException:
- $ref: "#/components/examples/IdpNotFoundException"
"5xx":
$ref: "../openapi.yaml#/components/responses/ServerErrorResponse"
@@ -186,12 +188,17 @@ paths:
schema:
$ref: "#/components/schemas/IdpGroupResponse"
examples:
- IdpGroupResponse:
- $ref: "#/components/examples/IdpGroupResponse"
+ IdpGroupAddResponse:
+ $ref: "#/components/examples/IdpGroupAddResponse"
"400":
- $ref: "../openapi.yaml#/components/responses/BadRequestErrorResponse"
- "403":
- $ref: "#/components/responses/IdpForbiddenErrorResponse"
+ description: Bad Request - The request body is invalid
+ content:
+ application/vnd.gravitino.v1+json:
+ schema:
+ $ref: "../openapi.yaml#/components/schemas/ErrorModel"
+ examples:
+ IllegalArgumentException:
+ $ref:
"#/components/examples/IdpAddGroupIllegalArgumentException"
"409":
description: Conflict - The built-in IDP group already exists
content:
@@ -200,7 +207,9 @@ paths:
$ref: "../openapi.yaml#/components/schemas/ErrorModel"
examples:
AlreadyExistsException:
- $ref: "#/components/examples/IdpAlreadyExistsException"
+ $ref: "#/components/examples/IdpGroupAlreadyExistsException"
+ "403":
+ $ref: "#/components/responses/IdpForbiddenErrorResponse"
"5xx":
$ref: "../openapi.yaml#/components/responses/ServerErrorResponse"
@@ -212,7 +221,7 @@ paths:
tags:
- IDP
summary: Get built-in IDP group
- description: Returns the specified built-in IDP group, including member
usernames.
+ description: Returns the specified built-in IDP group, including member
usernames (empty if none; the example shows a group that already has members).
operationId: getIdpGroup
responses:
"200":
@@ -222,8 +231,8 @@ paths:
schema:
$ref: "#/components/schemas/IdpGroupResponse"
examples:
- IdpGroupResponse:
- $ref: "#/components/examples/IdpGroupResponse"
+ IdpGroupGetResponse:
+ $ref: "#/components/examples/IdpGroupGetResponse"
"403":
$ref: "#/components/responses/IdpForbiddenErrorResponse"
"404":
@@ -234,7 +243,7 @@ paths:
$ref: "../openapi.yaml#/components/schemas/ErrorModel"
examples:
NotFoundException:
- $ref: "#/components/examples/IdpNotFoundException"
+ $ref: "#/components/examples/IdpGroupNotFoundException"
"5xx":
$ref: "../openapi.yaml#/components/responses/ServerErrorResponse"
@@ -242,25 +251,15 @@ paths:
tags:
- IDP
summary: Remove built-in IDP group
+ description: Removes the specified built-in IDP group.
operationId: removeIdpGroup
parameters:
- $ref: "../openapi.yaml#/components/parameters/force"
responses:
"200":
$ref: "../openapi.yaml#/components/responses/RemoveResponse"
- "400":
- $ref: "../openapi.yaml#/components/responses/BadRequestErrorResponse"
"403":
$ref: "#/components/responses/IdpForbiddenErrorResponse"
- "404":
- description: Not Found - The specified built-in IDP group does not
exist
- content:
- application/vnd.gravitino.v1+json:
- schema:
- $ref: "../openapi.yaml#/components/schemas/ErrorModel"
- examples:
- NotFoundException:
- $ref: "#/components/examples/IdpNotFoundException"
"405":
description: Method Not Allowed - The group is not empty and force
is false
content:
@@ -281,9 +280,7 @@ paths:
tags:
- IDP
summary: Change built-in IDP group membership
- description: >
- Adds and/or removes users from the specified built-in IDP group in a
single request,
- similar to tag association. At least one of `usersToAdd` or
`usersToRemove` must be set.
+ description: Adds and/or removes users from the specified built-in IDP
group.
operationId: changeIdpGroupMembership
requestBody:
required: true
@@ -302,10 +299,17 @@ paths:
schema:
$ref: "#/components/schemas/IdpGroupResponse"
examples:
- IdpGroupResponse:
- $ref: "#/components/examples/IdpGroupResponse"
+ IdpGroupMembershipResponse:
+ $ref: "#/components/examples/IdpGroupMembershipResponse"
"400":
- $ref: "../openapi.yaml#/components/responses/BadRequestErrorResponse"
+ description: Bad Request - The request body is invalid
+ content:
+ application/vnd.gravitino.v1+json:
+ schema:
+ $ref: "../openapi.yaml#/components/schemas/ErrorModel"
+ examples:
+ IllegalArgumentException:
+ $ref:
"#/components/examples/IdpGroupMembershipIllegalArgumentException"
"403":
$ref: "#/components/responses/IdpForbiddenErrorResponse"
"404":
@@ -315,8 +319,10 @@ paths:
schema:
$ref: "../openapi.yaml#/components/schemas/ErrorModel"
examples:
- NotFoundException:
- $ref: "#/components/examples/IdpNotFoundException"
+ GroupNotFoundException:
+ $ref: "#/components/examples/IdpGroupUpdateNotFoundException"
+ UserNotFoundException:
+ $ref:
"#/components/examples/IdpMembershipUserNotFoundException"
"5xx":
$ref: "../openapi.yaml#/components/responses/ServerErrorResponse"
@@ -329,11 +335,13 @@ components:
properties:
name:
type: string
+ maxLength: 128
description: The username of the built-in IDP user
groups:
type: array
items:
type: string
+ maxLength: 128
description: The built-in IDP groups the user belongs to
IdpGroup:
@@ -343,11 +351,13 @@ components:
properties:
name:
type: string
+ maxLength: 128
description: The name of the built-in IDP group
users:
type: array
items:
type: string
+ maxLength: 128
description: The usernames of members in the built-in IDP group
AddUserRequest:
@@ -358,13 +368,16 @@ components:
properties:
user:
type: string
- description: >
- The username to add. Request payloads use `user`, while user
objects in
- responses use `name` (see IdpUser), matching the server JSON field
names.
+ minLength: 1
+ maxLength: 128
+ pattern: "^[^:]*$"
+ description: The username to add.
password:
type: string
format: password
- description: The password of the built-in IDP user to add
+ minLength: 12
+ maxLength: 64
+ description: The password of the built-in IDP user to add.
writeOnly: true
ChangePasswordRequest:
@@ -375,7 +388,9 @@ components:
password:
type: string
format: password
- description: The new password of the built-in IDP user
+ minLength: 12
+ maxLength: 64
+ description: The new password of the built-in IDP user.
writeOnly: true
AddGroupRequest:
@@ -385,9 +400,9 @@ components:
properties:
group:
type: string
- description: >
- The group name to add. Request payloads use `group`, while group
objects in
- responses use `name` (see IdpGroup), matching the server JSON
field names.
+ minLength: 1
+ maxLength: 128
+ description: The group name to add.
GroupMembershipChangeRequest:
type: object
@@ -401,12 +416,16 @@ components:
type: array
items:
type: string
+ minLength: 1
+ maxLength: 128
minItems: 1
description: The usernames to add to the built-in IDP group
usersToRemove:
type: array
items:
type: string
+ minLength: 1
+ maxLength: 128
minItems: 1
description: The usernames to remove from the built-in IDP group
@@ -436,22 +455,28 @@ components:
responses:
IdpForbiddenErrorResponse:
- description: Forbidden - Built-in IDP REST APIs are disabled or the
caller is not authorized
+ description:
+ Forbidden - Only callers listed in
`gravitino.authorization.serviceAdmins` may
+ manage built-in IDP users and groups. Unauthenticated requests and
authenticated
+ non-service-admin users receive this response.
content:
application/vnd.gravitino.v1+json:
schema:
$ref: "../openapi.yaml#/components/schemas/ErrorModel"
+ examples:
+ ForbiddenException:
+ $ref: "#/components/examples/IdpForbiddenException"
examples:
AddUserRequest:
value: {
"user": "alice",
- "password": "secret"
+ "password": "Passw0rd-1234"
}
ChangePasswordRequest:
value: {
- "password": "new-secret"
+ "password": "Passw0rd-5678"
}
AddGroupRequest:
@@ -465,7 +490,16 @@ components:
"usersToRemove": ["carol"]
}
- IdpUserResponse:
+ IdpUserAddResponse:
+ value: {
+ "code": 0,
+ "user": {
+ "name": "alice",
+ "groups": []
+ }
+ }
+
+ IdpUserGetResponse:
value: {
"code": 0,
"user": {
@@ -474,7 +508,34 @@ components:
}
}
- IdpGroupResponse:
+ IdpUserUpdateResponse:
+ value: {
+ "code": 0,
+ "user": {
+ "name": "alice",
+ "groups": ["engineers"]
+ }
+ }
+
+ IdpGroupAddResponse:
+ value: {
+ "code": 0,
+ "group": {
+ "name": "engineers",
+ "users": []
+ }
+ }
+
+ IdpGroupGetResponse:
+ value: {
+ "code": 0,
+ "group": {
+ "name": "engineers",
+ "users": ["alice", "bob"]
+ }
+ }
+
+ IdpGroupMembershipResponse:
value: {
"code": 0,
"group": {
@@ -483,23 +544,93 @@ components:
}
}
+ IdpAddUserIllegalArgumentException:
+ value: {
+ "code": 1001,
+ "type": "IllegalArgumentException",
+ "message": "Failed to operate built-in IdP user [] operation [ADD],
reason [\"user\" field is required and cannot be empty]"
+ }
+
+ IdpChangePasswordIllegalArgumentException:
+ value: {
+ "code": 1001,
+ "type": "IllegalArgumentException",
+ "message": "Failed to operate built-in IdP user [alice] operation
[UPDATE], reason [\"password\" field is required and cannot be empty]"
+ }
+
+ IdpAddGroupIllegalArgumentException:
+ value: {
+ "code": 1001,
+ "type": "IllegalArgumentException",
+ "message": "Failed to operate built-in IdP group [] operation [ADD],
reason [\"group\" field is required and cannot be empty]"
+ }
+
+ IdpGroupMembershipIllegalArgumentException:
+ value: {
+ "code": 1001,
+ "type": "IllegalArgumentException",
+ "message": "Failed to operate built-in IdP group [engineers] operation
[UPDATE], reason [usersToAdd and usersToRemove cannot both be null]"
+ }
+
IdpNotFoundException:
value: {
"code": 1003,
"type": "NotFoundException",
- "message": "Failed to operate built-in IdP user [alice] operation
[GET], reason [User does not exist]"
+ "message": "Failed to operate built-in IdP user [missing-user]
operation [GET], reason [IdP user not found: missing-user]"
}
IdpAlreadyExistsException:
value: {
"code": 1004,
"type": "AlreadyExistsException",
- "message": "Failed to operate built-in IdP user [] operation [ADD],
reason [User already exists]"
+ "message": "Failed to operate built-in IdP user [alice] operation
[ADD], reason [IdP user alice already exists]"
}
- IdpGroupNotEmptyException:
+ IdpUserUpdateNotFoundException:
+ value: {
+ "code": 1003,
+ "type": "NotFoundException",
+ "message": "Failed to operate built-in IdP user [missing-user]
operation [UPDATE], reason [IdP user not found: missing-user]"
+ }
+
+ IdpGroupNotFoundException:
value: {
"code": 1003,
+ "type": "NotFoundException",
+ "message": "Failed to operate built-in IdP group [missing-group]
operation [GET], reason [IdP group not found: missing-group]"
+ }
+
+ IdpGroupUpdateNotFoundException:
+ value: {
+ "code": 1003,
+ "type": "NotFoundException",
+ "message": "Failed to operate built-in IdP group [missing-group]
operation [UPDATE], reason [IdP group not found: missing-group]"
+ }
+
+ IdpMembershipUserNotFoundException:
+ value: {
+ "code": 1003,
+ "type": "NotFoundException",
+ "message": "Failed to operate built-in IdP group [engineers] operation
[UPDATE], reason [IdP user not found: missing-user]"
+ }
+
+ IdpGroupAlreadyExistsException:
+ value: {
+ "code": 1004,
+ "type": "AlreadyExistsException",
+ "message": "Failed to operate built-in IdP group [engineers] operation
[ADD], reason [IdP group engineers already exists]"
+ }
+
+ IdpGroupNotEmptyException:
+ value: {
+ "code": 1006,
"type": "IllegalStateException",
- "message": "Failed to operate built-in IdP group [engineers] operation
[REMOVE], reason [Group is not empty]"
+ "message": "Failed to operate built-in IdP group [engineers] operation
[REMOVE], reason [IdP group engineers is not empty, use force=true to delete
it]"
+ }
+
+ IdpForbiddenException:
+ value: {
+ "code": 1008,
+ "type": "ForbiddenException",
+ "message": "Only service admins can manage built-in IdP users and
groups."
}
diff --git
a/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/basic/IdpCredentialValidator.java
b/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/basic/IdpCredentialValidator.java
index 45701a0fc9..b27855c577 100644
---
a/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/basic/IdpCredentialValidator.java
+++
b/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/basic/IdpCredentialValidator.java
@@ -29,12 +29,28 @@ public final class IdpCredentialValidator {
private static final int MAX_PASSWORD_LENGTH = 64;
+ /** Matches {@code idp_user_meta.user_name} and {@code
idp_group_meta.group_name} column size. */
+ private static final int MAX_NAME_LENGTH = 128;
+
private IdpCredentialValidator() {}
public static void validateUsername(String username) {
Preconditions.checkArgument(
StringUtils.isNotBlank(username), "\"user\" field is required and
cannot be empty");
Preconditions.checkArgument(!username.contains(":"), "User name cannot
contain a colon (:)");
+ Preconditions.checkArgument(
+ username.length() <= MAX_NAME_LENGTH,
+ "Username must not exceed %s characters",
+ MAX_NAME_LENGTH);
+ }
+
+ public static void validateGroupName(String groupName) {
+ Preconditions.checkArgument(
+ StringUtils.isNotBlank(groupName), "\"group\" field is required and
cannot be empty");
+ Preconditions.checkArgument(
+ groupName.length() <= MAX_NAME_LENGTH,
+ "Group name must not exceed %s characters",
+ MAX_NAME_LENGTH);
}
public static void validatePassword(String password) {
diff --git
a/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/dto/requests/AddGroupRequest.java
b/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/dto/requests/AddGroupRequest.java
index 54e0c92c5d..fb1b91aa93 100644
---
a/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/dto/requests/AddGroupRequest.java
+++
b/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/dto/requests/AddGroupRequest.java
@@ -20,13 +20,12 @@
package org.apache.gravitino.idp.dto.requests;
import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.Preconditions;
import lombok.Builder;
import lombok.EqualsAndHashCode;
import lombok.Getter;
import lombok.ToString;
import lombok.extern.jackson.Jacksonized;
-import org.apache.commons.lang3.StringUtils;
+import org.apache.gravitino.idp.basic.IdpCredentialValidator;
import org.apache.gravitino.rest.RESTRequest;
/** Represents a request to add a built-in IdP group. */
@@ -62,7 +61,6 @@ public class AddGroupRequest implements RESTRequest {
*/
@Override
public void validate() throws IllegalArgumentException {
- Preconditions.checkArgument(
- StringUtils.isNotBlank(group), "\"group\" field is required and cannot
be empty");
+ IdpCredentialValidator.validateGroupName(group);
}
}
diff --git
a/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/web/IdpRESTUtils.java
b/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/web/IdpRESTUtils.java
index 047f490be8..75ab056738 100644
---
a/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/web/IdpRESTUtils.java
+++
b/plugins/idp-basic/src/main/java/org/apache/gravitino/idp/web/IdpRESTUtils.java
@@ -69,11 +69,10 @@ public final class IdpRESTUtils {
public static Response handleException(
String resourceType, IdpOperationType op, String name, Exception e) {
- String formatted = StringUtils.isBlank(name) ? "" : " [" + name + "]";
String errorMsg =
String.format(
- "Failed to operate built-in IdP %s %s operation [%s], reason [%s]",
- resourceType, formatted, op.name(), e.getMessage());
+ "Failed to operate built-in IdP %s [%s] operation [%s], reason
[%s]",
+ resourceType, StringUtils.defaultString(name), op.name(),
e.getMessage());
LOG.warn(errorMsg, e);
return toErrorResponse(errorMsg, e);
}
diff --git
a/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddGroupRequest.java
b/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddGroupRequest.java
index cdc24d1f60..77f3c19d21 100644
---
a/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddGroupRequest.java
+++
b/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddGroupRequest.java
@@ -54,5 +54,7 @@ public class TestAddGroupRequest {
Assertions.assertThrows(IllegalArgumentException.class, () -> new
AddGroupRequest().validate());
Assertions.assertThrows(
IllegalArgumentException.class, () -> new AddGroupRequest("
").validate());
+ Assertions.assertThrows(
+ IllegalArgumentException.class, () -> new
AddGroupRequest("a".repeat(129)).validate());
}
}
diff --git
a/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddUserRequest.java
b/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddUserRequest.java
index 8bd598eb9f..3754a387b3 100644
---
a/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddUserRequest.java
+++
b/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/dto/requests/TestAddUserRequest.java
@@ -64,6 +64,9 @@ public class TestAddUserRequest {
() -> new AddUserRequest("user:name", VALID_PASSWORD).validate());
Assertions.assertThrows(
IllegalArgumentException.class, () -> new AddUserRequest("test_user",
"short").validate());
+ Assertions.assertThrows(
+ IllegalArgumentException.class,
+ () -> new AddUserRequest("a".repeat(129), VALID_PASSWORD).validate());
}
@Test
diff --git
a/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/integration/test/IdpRESTApiIT.java
b/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/integration/test/IdpRESTApiIT.java
index 899c143e98..a732f3a5a1 100644
---
a/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/integration/test/IdpRESTApiIT.java
+++
b/plugins/idp-basic/src/test/java/org/apache/gravitino/idp/integration/test/IdpRESTApiIT.java
@@ -141,6 +141,10 @@ public class IdpRESTApiIT extends BaseIT {
400,
post("/idp/users", new AddUserRequest(USER1, " ")),
ErrorConstants.ILLEGAL_ARGUMENTS_CODE);
+ assertError(
+ 400,
+ post("/idp/users", new AddUserRequest("a".repeat(129), USER_PASSWORD)),
+ ErrorConstants.ILLEGAL_ARGUMENTS_CODE);
assertError(
409,
post("/idp/users", new AddUserRequest(USER1, USER_PASSWORD)),
@@ -179,6 +183,10 @@ public class IdpRESTApiIT extends BaseIT {
assertError(
409, post("/idp/groups", new AddGroupRequest(GROUP1)),
ErrorConstants.ALREADY_EXISTS_CODE);
+ assertError(
+ 400,
+ post("/idp/groups", new AddGroupRequest("a".repeat(129))),
+ ErrorConstants.ILLEGAL_ARGUMENTS_CODE);
assertError(
404,
get("/idp/groups/" + MISSING_GROUP, ADMIN, ADMIN_PASSWORD),
