Jason Fehr has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24472 )
Change subject: IMPALA-12232: Validate JWT aud/iss claims ...................................................................... IMPALA-12232: Validate JWT aud/iss claims Validate configured audienceClaims and issuerClaims after token signature verification for both JWT and OAuth auth flows, including HS2 HTTP and webserver paths. Extend oauth_servers parsing to accept audienceClaims/issuerClaims and align claim validation behavior with JWT RFC requirements for aud/iss semantics. Address follow-up review feedback by adding targeted null checks, preserving HTTP error response headers in test transport code, and strengthening JwtHttp negative tests to assert claim-specific auth failures from WWW-Authenticate headers. Remove obsolete --jwt_validate_signature usage in JwtHttpTest startup flags so custom-cluster tests use supported oauth_servers options. Testing: - Linux: fe mvn test -Dtest='JwtHttpTest#testJwtAuthWithWrongIssuerClaim+ testJwtAuthWithWrongAudienceClaim+testJwtAuthWithMissingAudienceClaim' - Linux: be/build/debug/util/oauth-server-config-test Change-Id: I0a00b126359f2bc7e2f73d894cebc2b9014c7375 Assisted-by: GPT-5.3 (Cursor) Reviewed-on: http://gerrit.cloudera.org:8080/24472 Tested-by: Impala Public Jenkins <[email protected]> Reviewed-by: Jason Fehr <[email protected]> --- M be/src/util/jwt-util-test.cc M be/src/util/jwt-util.cc M be/src/util/jwt-util.h M be/src/util/oauth-server-config-test.cc M be/src/util/oauth-server-config.cc M be/src/util/oauth-server-config.h M be/src/util/oauth-servers-manager-test.cc M be/src/util/oauth-servers-manager.cc M be/src/util/oauth-servers-manager.h M fe/src/test/java/org/apache/impala/customcluster/JwtHttpTest.java M fe/src/test/java/org/apache/impala/customcluster/THttpClientWithHeaders.java 11 files changed, 553 insertions(+), 10 deletions(-) Approvals: Impala Public Jenkins: Verified Jason Fehr: Looks good to me, approved -- To view, visit http://gerrit.cloudera.org:8080/24472 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: I0a00b126359f2bc7e2f73d894cebc2b9014c7375 Gerrit-Change-Number: 24472 Gerrit-PatchSet: 21 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anonymous Coward (934) Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]>
