Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/24472 )
Change subject: IMPALA-12232: Validate JWT aud/iss claims ...................................................................... Patch Set 10: -Code-Review (2 comments) http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-server-config.cc File be/src/util/oauth-server-config.cc: http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-server-config.cc@172 PS10, Line 172: RETURN_IF_ERROR(ReadOptionalStringArrayField( : obj, "audienceClaims", &config.audience_claims)); : RETURN_IF_ERROR(ReadOptionalStringArrayField( : obj, "issuerClaims", &config.issuer_claims)); > Should we also reject the edge case here when audienceClaims and issuerClai To maintain backwards compatibility, empty values indicate to accept any audience/issuer claims. http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-servers-manager-test.cc File be/src/util/oauth-servers-manager-test.cc: http://gerrit.cloudera.org:8080/#/c/24472/10/be/src/util/oauth-servers-manager-test.cc@127 PS10, Line 127: TEST(OAuthServersManagerTest, VerifyTokenFromSecondServerWhenFirstAudienceDoesNotMatch) { > I might have missed it but can we also add a negative test where a single s Good catch. I don't see any negative tests in JwtHttpTest.java that prove audience/issuer validation is happening and that tokens with the wrong audience/issue are rejected. -- To view, visit http://gerrit.cloudera.org:8080/24472 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I0a00b126359f2bc7e2f73d894cebc2b9014c7375 Gerrit-Change-Number: 24472 Gerrit-PatchSet: 10 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anonymous Coward (934) Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]> Gerrit-Comment-Date: Tue, 29 Sep 2026 22:43:24 +0000 Gerrit-HasComments: Yes
