Anubhav Jindal created IMPALA-15372:
---------------------------------------
Summary: Improve JWT/OAuth logging and metric attribution when
both legacy auth modes are enabled
Key: IMPALA-15372
URL: https://issues.apache.org/jira/browse/IMPALA-15372
Project: IMPALA
Issue Type: Improvement
Reporter: Anubhav Jindal
Assignee: Anubhav Jindal
*Background*
In IMPALA-14799, bearer-token verification was unified via OAuthServersManager.
When both legacy flags are enabled at the same time (`--jwt_token_auth=true` and
`--oauth_token_auth=true`), Webserver authentication can verify the token
correctly but still attribute success/failure metrics and some log messages
based
on server flag precedence rather than the actual verification path.
*Problem*
Current behavior in `be/src/util/webserver.cc` can produce misleading
observability:
1) Success metric attribution can be inaccurate when both legacy modes are on.
2) Failure logging may report "Invalid JWT token provided" in cases where OAuth
mode was also in play.
3) This makes operational dashboards and troubleshooting harder in mixed-mode
deployments.
*Repro (example)*
1) Start Impala with both legacy token auth modes enabled:
--jwt_token_auth=true
--oauth_token_auth=true
(with valid jwks settings for both)
2) Send bearer tokens representing different providers.
3) Observe token auth counters/logs and compare with the actual matched
verifier.
*Expected Behavior*
- Metrics should reflect the actual verifier/provider path used for the request.
- Log messages should be provider-accurate (or explicitly generic where
attribution is not possible).
- Behavior should remain backward-compatible for auth success/failure outcomes.
*Proposed Fix*
- Extend token verification path to return provider/mode attribution metadata
(e.g. matched legacy mode/provider identity).
- Use returned metadata to increment the correct jwt/oauth counters.
- Update log messages to avoid misleading provider labels.
- Keep existing auth semantics unchanged; this is an observability correctness
fix.
*Acceptance Criteria*
- In mixed legacy mode, successful JWT-authenticated requests increment JWT
success counter only.
- In mixed legacy mode, successful OAuth-authenticated requests increment OAuth
success counter only.
- Failure counters/logs align with actual verification attempts/results.
- Existing JWT-only and OAuth-only behavior remains unchanged.
- Targeted unit/integration tests added/updated to validate attribution and
logs.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
