Hello Gokul Kolady, Yida Wu, Abhishek Rawat, Jason Fehr, Anonymous Coward
(934), Impala Public Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/24472
to look at the new patch set (#13).
Change subject: IMPALA-12232: Validate JWT aud/iss claims
......................................................................
IMPALA-12232: Validate JWT aud/iss claims
Validate configured audienceClaims and issuerClaims after token signature
verification for both JWT and OAuth auth flows, including HS2 HTTP and
webserver paths.
Extend oauth_servers parsing to accept audienceClaims/issuerClaims and align
claim validation behavior with JWT RFC requirements for aud/iss semantics.
Address follow-up review feedback by adding targeted null checks, preserving
HTTP error response headers in test transport code, and strengthening
JwtHttp negative tests to assert claim-specific auth failures from
WWW-Authenticate headers.
Remove obsolete --jwt_validate_signature usage in JwtHttpTest startup flags
so custom-cluster tests use supported oauth_servers options.
Testing:
- Linux: fe mvn test
-Dtest='JwtHttpTest#testJwtAuthWithWrongIssuerClaim+testJwtAuthWithWrongAudienceClaim+testJwtAuthWithMissingAudienceClaim'
- Linux: be/build/debug/util/oauth-server-config-test
Change-Id: I0a00b126359f2bc7e2f73d894cebc2b9014c7375
Assisted-by: GPT-5.3 (Cursor)
---
M be/src/util/jwt-util-test.cc
M be/src/util/jwt-util.cc
M be/src/util/jwt-util.h
M be/src/util/oauth-server-config-test.cc
M be/src/util/oauth-server-config.cc
M be/src/util/oauth-server-config.h
M be/src/util/oauth-servers-manager-test.cc
M be/src/util/oauth-servers-manager.cc
M be/src/util/oauth-servers-manager.h
M fe/src/test/java/org/apache/impala/customcluster/JwtHttpTest.java
M fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java
11 files changed, 548 insertions(+), 10 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/72/24472/13
--
To view, visit http://gerrit.cloudera.org:8080/24472
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I0a00b126359f2bc7e2f73d894cebc2b9014c7375
Gerrit-Change-Number: 24472
Gerrit-PatchSet: 13
Gerrit-Owner: Anubhav Jindal <[email protected]>
Gerrit-Reviewer: Abhishek Rawat <[email protected]>
Gerrit-Reviewer: Anonymous Coward (934)
Gerrit-Reviewer: Anubhav Jindal <[email protected]>
Gerrit-Reviewer: Gokul Kolady <[email protected]>
Gerrit-Reviewer: Impala Public Jenkins <[email protected]>
Gerrit-Reviewer: Jason Fehr <[email protected]>
Gerrit-Reviewer: Yida Wu <[email protected]>
