Aias00 opened a new issue, #2161: URL: https://github.com/apache/rocketmq-dashboard/issues/2161
## Problem Studio authentication currently reads users from configuration and retains bearer sessions only in process memory. It does not expose a stable user ID, account disablement, password rotation, or persistent session revocation. ## Scope - Add Studio-local user and session tables, distinct from RocketMQ ACL users. - Bootstrap the first database users from existing `studio.auth.users` only when the table is empty. - Use immutable user IDs, salted password hashes, and persisted token hashes. - Add basic create/list/enable/disable/reset-password operations for administrators. - Add self-service password change and revoke sessions on disable/password change. - Add a minimal Studio user-management UI. ## Out of scope Roles beyond the existing admin flag, organizations/tenants, SSO/OIDC, and external identity providers. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
