Yida Wu has posted comments on this change. ( http://gerrit.cloudera.org:8080/24448 )
Change subject: IMPALA-14799: Add oauth_servers support and tests ...................................................................... Patch Set 18: (5 comments) http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/rpc/authentication.cc File be/src/rpc/authentication.cc: http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/rpc/authentication.cc@a185 PS18, Line 185: : : : : Should we say jwt_validate_signature DEPRECATED instead of removing? http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/rpc/authentication.cc@a231 PS18, Line 231: : : : : : Should we say oauth_jwt_validate_signature DEPRECATED instead of removing? http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/oauth-server-config.h File be/src/util/oauth-server-config.h: http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/oauth-server-config.h@32 PS18, Line 32: 4400 Curious that why this is 4400 for update frequency, it doesn't seem like a standard value http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/webserver.cc File be/src/util/webserver.cc: http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/webserver.cc@777 PS18, Line 777: if (use_jwt_) { : if (OAuthTokenAuth(bearer_token, request_info, &response_headers)) { : total_jwt_token_auth_success_->Increment(1); : authenticated = true; : check_csrf_protection = false; : // TODO: cookies are not added, but are not needed right now : } : } : if (!authenticated && use_oauth_) { : if (OAuthTokenAuth(bearer_token, request_info, &response_headers)) { : total_oauth_token_auth_success_->Increment(1); : authenticated = true; : check_csrf_protection = false; : // TODO: cookies are not added, but are not needed right now : } : } : if (!authenticated) { : if (use_jwt_) { : LOG(INFO) << "Invalid JWT token provided"; : total_jwt_token_auth_failure_->Increment(1); : } : if (use_oauth_) { : LOG(INFO) << "Invalid OAuth token provided"; : total_oauth_token_auth_failure_->Increment(1); : } : } Another question is that if it possible both use_jwt_ and use_oauth_ be true? If yes, and they are using the same OAuthTokenAuth(), how can we confirm which is used if OAuthTokenAuth() doesn't return anything? If no, can we add a DCHECK somewhere to say use_jwt_ and use_oauth_ can't be true at the same time? http://gerrit.cloudera.org:8080/#/c/24448/18/be/src/util/webserver.cc@777 PS18, Line 777: if (use_jwt_) { : if (OAuthTokenAuth(bearer_token, request_info, &response_headers)) { : total_jwt_token_auth_success_->Increment(1); : authenticated = true; : check_csrf_protection = false; : // TODO: cookies are not added, but are not needed right now : } : } : if (!authenticated && use_oauth_) { : if (OAuthTokenAuth(bearer_token, request_info, &response_headers)) { : total_oauth_token_auth_success_->Increment(1); : authenticated = true; : check_csrf_protection = false; : // TODO: cookies are not added, but are not needed right now : } : } : if (!authenticated) { : if (use_jwt_) { : LOG(INFO) << "Invalid JWT token provided"; : total_jwt_token_auth_failure_->Increment(1); : } : if (use_oauth_) { : LOG(INFO) << "Invalid OAuth token provided"; : total_oauth_token_auth_failure_->Increment(1); : } : } How about we refactoring this using less checks like this since using the same OAuthTokenAuth() now: if (use_jwt_ || use_oauth_) { if (OAuthTokenAuth(bearer_token, request_info, &response_headers)) { authenticated = true; check_csrf_protection = false; if (use_jwt_) total_jwt_token_auth_success_->Increment(1); if (use_oauth_) total_oauth_token_auth_success_->Increment(1); } else { if (use_jwt_) { LOG(INFO) << "Invalid JWT token provided"; total_jwt_token_auth_failure_->Increment(1); } if (use_oauth_) { LOG(INFO) << "Invalid OAuth token provided"; total_oauth_token_auth_failure_->Increment(1); } } } -- To view, visit http://gerrit.cloudera.org:8080/24448 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ib29ff36600406ba59c10f29d79cc632020f4a3f7 Gerrit-Change-Number: 24448 Gerrit-PatchSet: 18 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]> Gerrit-Comment-Date: Fri, 21 Aug 2026 04:38:57 +0000 Gerrit-HasComments: Yes
