Yida Wu has posted comments on this change. ( http://gerrit.cloudera.org:8080/24472 )
Change subject: IMPALA-12232: Validate JWT aud/iss claims ...................................................................... Patch Set 10: (4 comments) http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-server-config.cc File be/src/util/oauth-server-config.cc: http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-server-config.cc@172 PS10, Line 172: RETURN_IF_ERROR(ReadOptionalStringArrayField( : obj, "audienceClaims", &config.audience_claims)); : RETURN_IF_ERROR(ReadOptionalStringArrayField( : obj, "issuerClaims", &config.issuer_claims)); Should we also reject the edge case here when audienceClaims and issuerClaims are empty array [] or empty string [""], as these cases doesn't seem meaningful? And can we can add tests for empty array [] or empty string [""] for audienceClaims in oauth-servers-manager-test.cc? http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-servers-manager-test.cc File be/src/util/oauth-servers-manager-test.cc: http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-servers-manager-test.cc@127 PS10, Line 127: TEST(OAuthServersManagerTest, VerifyTokenFromSecondServerWhenFirstAudienceDoesNotMatch) { I might have missed it but can we also add a negative test where a single server is configured with "audienceClaims":["wrong-audience"], and we pass it a valid token just to prove the manager can block it? http://gerrit.cloudera.org:8080/#/c/24472/6/be/src/util/oauth-servers-manager.cc File be/src/util/oauth-servers-manager.cc: http://gerrit.cloudera.org:8080/#/c/24472/6/be/src/util/oauth-servers-manager.cc@62 PS6, Line 62: DCHECK(jwt_helpers_); : DCHECK(username_out != nullptr); : username_out->clear(); > Agreed. This is now handled in the per-server loop in Verify(), so claim mi Done http://gerrit.cloudera.org:8080/#/c/24472/6/be/src/util/oauth-servers-manager.cc@81 PS6, Line 81: RETURN_IF_ERROR(FindMatchingServer(decoded_token, next_idx, &matched_server_idx)); > Thanks. I kept signature verification before claim validation intentionally Ack -- To view, visit http://gerrit.cloudera.org:8080/24472 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I0a00b126359f2bc7e2f73d894cebc2b9014c7375 Gerrit-Change-Number: 24472 Gerrit-PatchSet: 10 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anonymous Coward (934) Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]> Gerrit-Comment-Date: Tue, 29 Sep 2026 21:08:53 +0000 Gerrit-HasComments: Yes
