vanphuoc3012 opened a new issue, #12200: URL: https://github.com/apache/gravitino/issues/12200
### Version
main branch
### Describe what's wrong
When using OIDC/OAuth authentication in the V2 Web UI, the metalakes page
can request metalake data before the authentication bootstrap finishes.
The auth provider resolves the auth type, obtains the OIDC access token,
fetches the server-resolved principal from `/api/authn/me`, and then updates
Redux auth state. However, the
metalakes page currently fetches metalakes as soon as the page mounts. This
can race with OIDC bootstrap.
As a result, the UI may send requests before `authType`, `authToken`, or
`authUser` are ready. Depending on timing, this can cause unauthorized
requests, redirects back to login, refresh
loops, or an empty/loading metalakes page after OIDC login.
### Expected behavior
The V2 Web UI should not fetch metalakes until OIDC authentication
bootstrap is complete.
For OAuth/OIDC mode, the metalakes page should wait until the user is
authenticated before sending metalake API requests.
### Error message and/or stacktrace
No consistent stacktrace. The symptom is timing-dependent.
Possible symptoms:
- The V2 Web UI redirects back to login after OIDC login.
- The metalakes page refreshes or reloads unexpectedly.
- The metalakes list does not load after successful OIDC login.
- API requests are sent before the OIDC token is ready.
### How to reproduce
1. Configure Gravitino with OIDC/OAuth authentication:
```properties
gravitino.authenticators = oauth
gravitino.authenticator.oauth.provider = oidc
gravitino.authenticator.oauth.clientId = <client-id>
gravitino.authenticator.oauth.authority = <oidc-authority>
gravitino.authenticator.oauth.scope = openid profile email
gravitino.authenticator.oauth.principalFields =
preferred_username,email,sub
```
2. Start Gravitino with V2 Web UI enabled.
3. Open the V2 Web UI.
4. Login through the OIDC provider.
5. Observe that the metalakes page can issue metalake API requests before
OAuth bootstrap completes.
### Additional context
web-v2/web/src/app/metalakes/page.js fetches metalakes immediately when the
page mounts:
```js
useEffect(() => {
dispatch(resetMetalakeStore())
dispatch(fetchMetalakes())
}, [dispatch])
```
For OIDC/OAuth, authentication is initialized asynchronously in:
```text
web-v2/web/src/lib/provider/session.js
```
The provider needs to:
1. Fetch auth configs.
2. Detect authType === 'oauth'.
3. Get the OIDC access token.
4. Fetch /api/authn/me.
5. Dispatch setAuthToken, setAuthUser, and authenticated/bootstrap state.
The metalakes page does not wait for this bootstrap to finish before
calling fetchMetalakes().
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
