Uh oh!
There was an error while loading. Please reload this page.
branch-4.1: [fix](auth) Fix HTTP API authentication framework for admin operations - #62411
Merged
yiguolei merged 10 commits intoApr 23, 2026
Merged
Conversation
…tions This commit implements a comprehensive HTTP API authentication system that distinguishes between public APIs, user APIs, and admin APIs. Key changes: FE (Frontend): - Add userIdentity field to ActionAuthorizationInfo for parameter passing - Modify RestBaseController.executeCheckPassword() to return authInfo - Add checkAdminAuth() helper method for admin privilege checks - Update 17 existing Actions to use authInfo.userIdentity pattern - Add admin auth checks to 10 Actions that previously lacked them - Remove dependency on ConnectContext.get() for better testability BE (Backend): - Add TPrivilegeType::NONE optimization to skip FE RPC for public APIs - Update HealthAction to use NONE privilege type (public access) - Convert StreamLoadAction to inherit from HttpHandlerWithAuth - Convert StreamLoad2PCAction to use LOAD privilege type - Convert HttpStreamAction to use LOAD privilege type - Remove duplicate _exec_env members (inherited from parent) Testing: - Add FE unit tests (HttpApiAuthTest.java) with 5 test cases - Add BE unit tests (http_auth_test.cpp) with 3 new test cases - Add comprehensive Docker system tests (test_http_api_auth.groovy) - All tests cover public API, user API, and admin API scenarios API Classification: - Public APIs (NONE): /api/health, /metrics - no admin required - User APIs (LOAD): stream load - require LOAD privilege - Admin APIs (ADMIN): /_set_config, /backends, etc. - require ADMIN The implementation is backward compatible via enable_all_http_auth flag (default: false). When enabled, it enforces proper authentication and authorization for all HTTP APIs. Files modified: 38 (27 FE + 8 BE + 3 tests) Lines changed: +282/-120 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
### What problem does this PR solve? Issue: HttpAuthTest was failing with double-free error due to incorrect evhttp_request lifecycle management in tests. Problem Summary: 1. When on_header returns -1, send_reply has been called internally which triggers evhttp_request cleanup. The test was then calling evhttp_request_free again, causing double-free. 2. Added proper comments explaining when to free evhttp_request and when not to. ### Release note None - internal test fix only. ### Check List (For Author) - Test: BE Unit Test - HttpAuthTest and HttpClientTest.enable_http_auth passed - Behavior changed: No - test only changes - Does this need documentation: No
Thearas
commented
Apr 12, 2026
Contributor
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
gavinchou
commented
Apr 12, 2026
ContributorAuthor
run buildall |
hello-stephen
commented
Apr 12, 2026
Contributor
FE UT Coverage ReportIncrement line coverage |
hello-stephen
commented
Apr 12, 2026
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
hello-stephen
commented
Apr 14, 2026
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
gavinchou
commented
Apr 22, 2026
ContributorAuthor
run buildall |
hello-stephen
commented
Apr 22, 2026
Contributor
FE UT Coverage ReportIncrement line coverage |
hello-stephen
commented
Apr 22, 2026
Contributor
FE Regression Coverage ReportIncrement line coverage |
hello-stephen
commented
Apr 22, 2026
Contributor
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
hello-stephen
commented
Apr 22, 2026
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
yiguolei
approved these changes
Apr 23, 2026
Contributor
PR approved by at least one committer and no changes requested. |
Contributor
PR approved by anyone and no changes requested. |
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pick #60761 to branch-4.1