L. C. Hsieh created SPARK-59270:
-----------------------------------
Summary: Run the JWT auth end-to-end walkthrough in CI
Key: SPARK-59270
URL: https://issues.apache.org/jira/browse/SPARK-59270
Project: Spark
Issue Type: Sub-task
Components: Connect
Affects Versions: connect-gateway-0.1.0
Reporter: L. C. Hsieh
Assignee: L. C. Hsieh
The deploy/examples/e2e-auth-jwt walkthrough is the only thing that exercises
the
Helm chart's auth block end to end. The in-process tests cover JwtAuthenticator
itself, but nothing rendered the chart's auth.type: jwt ConfigMap or drove a
real
PySpark client through the bearer-token transport, so a break in the chart's
auth
templating or in claim propagation would go unnoticed.
This adds an e2e-auth-jwt job to the E2E workflow, running in parallel with
e2e-smoke on its own kind cluster. It asserts:
- The chart renders auth.type: jwt with the expected issuer and claim mapping
(tenant_claim, groups_claim).
audit pipeline: the session.create event must report user_id=alice (not
anonymous), tenant=team-a, groups=devs,admins.
- Three rejection paths fail with UNAUTHENTICATED: an expired token, a token
signed
with the wrong secret, and no token at all.
- Signature-validation failures all report the same generic "invalid JWT"
message.
This is a deliberate property — a verifier that distinguishes "expired"
from "bad
signature" tells an attacker which half to work on — so it is asserted, not
just
observed.
- The auth.failure audit events use only the fixed reason values
invalid_token and
missing_token, and scg_auth_failures_total counts both.
Tokens are signed with an 8-line openssl helper taken from the walkthrough; no
JWT
library is needed. PySpark is pinned to 4.0.0 to match the backend image, as in
the
e2e-smoke job.
Verified by running the whole walkthrough locally first: the chart rendered the
expected auth block, the valid token produced user_id=alice in the audit log,
all
three rejection paths returned UNAUTHENTICATED with the expected messages, and
the
audit reasons and metrics matched (invalid_token x4, missing_token x2).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
