terrymanu commented on issue #39218: URL: https://github.com/apache/shardingsphere/issues/39218#issuecomment-5058138702
Hi @alexalves83, thanks for the question. Current ShardingSphere-Proxy does not support propagating a frontend user's identity or credentials to a backend storage database. This is best classified as a question about an unsupported capability, not a bug. Proxy authentication and backend database authentication are separate: - [`authority.users`](https://shardingsphere.apache.org/document/current/en/user-manual/shardingsphere-proxy/yaml-config/authority/) authenticates users to the ShardingSphere compute node and controls access to logical databases. - Each [storage data source](https://shardingsphere.apache.org/document/current/en/user-manual/shardingsphere-proxy/yaml-config/data-source/) has its own configured JDBC `username` and `password`. - After frontend authentication, Proxy records the user as a session `Grantee`, but the backend connection API has no user or credential parameter, and [`JDBCBackendDataSource`](https://github.com/apache/shardingsphere/blob/78865882e539133778f397f8a3e2ee8fec2613f6/proxy/backend/core/src/main/java/org/apache/shardingsphere/proxy/backend/connector/jdbc/datasource/JDBCBackendDataSource.java#L41-L87) obtains connections from the configured data source pool. Therefore, Doris sees the storage-unit account configured in ShardingSphere, not `alex.alves` or `maria.silva`. User impersonation, identity passthrough, backend credential delegation, and backend connections authenticated as each frontend user are not supported. The Doris Proxy plugin provides dialect and compatibility adaptation; it does not change this credential model. We also could not find a public issue, PR, or linked roadmap item that commits to this capability, so we cannot provide a planned version. Please use Proxy authority for Proxy-level access control and treat the backend credential as a storage service account. If native Doris audit logs, permissions, and resource attribution must use the original end-user identity, current ShardingSphere-Proxy does not meet that requirement. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
