[improvement](fe) Support LDAP default roles#63411
Open
Jungzhang wants to merge 1 commit into
Open
Conversation
Issue Number: N/A
Related PR: N/A
Problem Summary: LDAP temporary users could only receive roles mapped from LDAP groups and the built-in information_schema-only role. Add ldap_default_roles so every LDAP-authenticated user can receive configured Doris roles while still keeping LDAP group roles.
Support configuring default Doris roles for LDAP-authenticated users through ldap_default_roles.
- Test: Unit Test
- Ran `env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run 'org.apache.doris.mysql.authenticate.ldap.LdapManagerTest#testGetUserInfoWithLdapDefaultRoles'`
- Ran `env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run org.apache.doris.mysql.authenticate.ldap.LdapManagerTest`
- Ran `env JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home /Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn checkstyle:check -pl fe-core`
- Behavior changed: Yes. LDAP-authenticated users can receive configured default Doris roles in addition to LDAP group roles, and online updates of ldap_default_roles refresh LDAP user cache.
- Does this need documentation: Yes. Added ldap.conf template entry.
Jungzhang
requested review from
CalvinKirs,
dataroaring and
morningman
as code owners
Contributor
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
Author
|
run buildall |
6 tasks
Contributor
TPC-H: Total hot run time: 31028 ms |
Contributor
TPC-DS: Total hot run time: 170218 ms |
Contributor
FE Regression Coverage ReportIncrement line coverage |
Author
|
run feut |
Author
|
run nonConcurrent |
Author
|
@morningman PTAL when you have time. Could you also help trigger |
Contributor
FE Regression Coverage ReportIncrement line coverage |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this PR solve?
Issue Number: N/A
Related PR: N/A
Problem Summary:
LDAP temporary users could only receive roles mapped from LDAP groups and the built-in information_schema-only role. This PR adds
ldap_default_rolesso every LDAP-authenticated user can receive configured Doris roles while still keeping LDAP group roles.Release note
Support configuring default Doris roles for LDAP-authenticated users through
ldap_default_roles.Check List (For Author)
Test
env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run 'org.apache.doris.mysql.authenticate.ldap.LdapManagerTest#testGetUserInfoWithLdapDefaultRoles'env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run org.apache.doris.mysql.authenticate.ldap.LdapManagerTestenv JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home /Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn checkstyle:check -pl fe-coreBehavior changed:
ldap_default_rolesrefresh the LDAP user cache.Does this need documentation?
Check List (For Reviewer who merge this PR)