slievrly opened a new pull request, #8185:
URL: https://github.com/apache/incubator-seata/pull/8185
Adds signed-request authentication for the previously unauthenticated
NamingServer ↔ Seata Server control plane, with multi-tenant isolation via
cluster-id and permission scoping.
Components
----------
- common/security: reusable canonical-request builder, HMAC signer/verifier
(constant-time compare), nonce cache with pluggable clock, and structured
verification result.
- namingserver/security: inbound Servlet Filter enforcing signature +
namespace/cluster/vgroup allow-lists + per-route permission; outbound signer
for vGroup writes / Console proxy / MCP calls to TC.
- server/security: inbound filter for /vgroup/v1/* and /api/*/console/* with
its own allowed-callers table (supports two coexisting entries for
zero-downtime key rotation).
Both filters ship as Spring Boot auto-configuration gated by an enabled
flag, with WARN and ENFORCE modes for gray rollout. Secrets are loaded via a
SecretResolver supporting env:, base64: and plain: schemes to keep raw key
material out of config files.
Tests
-----
122 unit tests across three modules; common module coverage 93% instruction
/ 89% branch. An InteropIntegrationTest guards against wire-format drift
between the two sides.
Docs
----
docs/SECURITY_AUTH_GUIDE.md covers full config reference, three deployment
scenarios (single cluster / multi-tenant / Raft HA), key generation, zero-
downtime rotation, gray rollout, monitoring, and troubleshooting.
Also adds jakarta.servlet-api (provided scope) to server/pom.xml so the new
Spring Boot 4.x-compatible filter compiles.
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Please make sure you have read and understood the contributing
guidelines -->
- [ ] I have read the
[CONTRIBUTING.md](https://github.com/apache/incubator-seata/blob/2.x/CONTRIBUTING.md)
guidelines.
- [ ] I have registered the PR
[changes](https://github.com/apache/incubator-seata/tree/2.x/changes).
### Ⅰ. Describe what this PR did
### Ⅱ. Does this pull request fix one issue?
<!-- If that, add "fixes #xxx" below in the next line, for example, fixes
#97. -->
### Ⅲ. Why don't you add test cases (unit test/integration test)?
### Ⅳ. Describe how to verify it
### Ⅴ. Special notes for reviews
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
