lasdf1234 opened a new pull request, #11788:
URL: https://github.com/apache/gravitino/pull/11788
## Summary
- Add `IdpUserGroupsCache` to cache built-in IdP group names keyed by
username during Basic authentication, reducing relational store lookups on
repeated requests.
- Keep password verification on the lightweight `getIdpUserByUsername` path
for every request; only group membership is cached.
- Invalidate cached group names when users are removed, group membership
changes, or a group is force-deleted.
- Add server configs `gravitino.authenticator.basic.groupsCacheTtlSecs`
(default 3600) and `gravitino.authenticator.basic.groupsCacheSize` (default
10000), documented in the built-in IDP guide.
Fix: #11781
## Why are the changes needed?
Basic authentication previously loaded full user metadata (including group
membership) from the relational store on every request. Group authorization
adds extra DB work compared to user-only checks. This change caches group names
per username while preserving per-request password verification, as discussed
in the issue thread.
## User-facing changes
- New configuration keys:
- `gravitino.authenticator.basic.groupsCacheTtlSecs`
- `gravitino.authenticator.basic.groupsCacheSize`
## Test plan
- [x] `./gradlew :plugins:idp-basic:test -PskipITs`
- [x] `TestIdpUserGroupsCache` — cache hit/miss and invalidation
- [x] `TestIdpUserGroupManager` — auth with groups, wrong/old password,
cache invalidation on membership change
- [x] `TestBasicAuthenticator` and `TestBasicAuthenticationIntegration`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
