Open
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #17302 +/- ##
=========================================
Coverage 39.75% 39.76%
Complexity 282 282
=========================================
Files 5100 5099 -1
Lines 342232 342331 +99
Branches 43597 43624 +27
=========================================
+ Hits 136067 136118 +51
- Misses 206165 206213 +48 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens OpenID Connect (OIDC) authentication by validating more JWT claims (issuer/audience, expiration with bounded clock skew), adding a new openID_audience configuration, and relocating/expanding unit tests into node-commons to better cover OpenID authorizer behavior.
Changes:
- Add
openID_audienceto common configuration loading and templates, and enforce it when initializing OIDC via provider URL. - Strengthen
OpenIdAuthorizerJWT validation (issuer/audience checks, bounded clock skew) and reduce token exposure in logs. - Move/replace OpenID authorizer tests from
datanodetonode-commons, adding provider-metadata/JWKS-based tests.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| iotdb-core/node-commons/src/test/java/org/apache/iotdb/commons/auth/authorizer/OpenIdAuthorizerTest.java | New tests for JWT login/admin checks plus issuer/audience rejection using an in-process OIDC metadata/JWKS server. |
| iotdb-core/node-commons/src/test/java/org/apache/iotdb/commons/auth/authorizer/LocalFileAuthorizerTest.java | Fix test package to match node-commons path; remove datanode-only environment utility usage. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonDescriptor.java | Load the new openID_audience property from common properties. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/conf/CommonConfig.java | Add openIdAudience field with getter/setter. |
| iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/auth/authorizer/OpenIdAuthorizer.java | Enforce audience/issuer validation and bounded clock skew; introduce provider context loading. |
| iotdb-core/node-commons/src/assembly/resources/conf/iotdb-system.properties.template | Document and add openID_audience to the config template. |
| iotdb-core/node-commons/pom.xml | Add jjwt implementation/JSON modules for tests (but see review comments about scope). |
| iotdb-core/datanode/src/test/java/org/apache/iotdb/db/auth/authorizer/OpenIdAuthorizerTest.java | Remove old datanode-level OpenID authorizer test. |
| iotdb-core/datanode/pom.xml | Remove OpenID-test-only dependencies now that tests moved to node-commons. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| URL url = new URI(providerMetadata.getJWKSetURI().toString()).toURL(); | ||
| logger.debug("Using url {}", url); | ||
| return getProviderRsaJwk(url.openStream()); | ||
| return new ProviderContext(getProviderRsaJwk(url.openStream()), issuer, acceptedAudiences); |
| claims = validateToken(token); | ||
| } catch (JwtException e) { | ||
| logger.error("Unable to login the user with Username (token) {}", token, e); | ||
| logger.error("Unable to login the user with Username (token), {}", e.getMessage()); |
| claims = validateToken(token); | ||
| } catch (JwtException e) { | ||
| logger.warn("Unable to validate token {}!", token, e); | ||
| logger.warn("Unable to validate token! {}", e.getMessage()); |
Comment on lines
80
to
+84
| // if using org.apache.iotdb.db.auth.authorizer.OpenIdAuthorizer, openID_url is needed. | ||
| config.setOpenIdProviderUrl( | ||
| properties.getProperty("openID_url", config.getOpenIdProviderUrl()).trim()); | ||
| config.setOpenIdAudience( | ||
| properties.getProperty("openID_audience", config.getOpenIdAudience()).trim()); |
Comment on lines
+155
to
+160
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>io.jsonwebtoken</groupId> | ||
| <artifactId>jjwt-jackson</artifactId> | ||
| <scope>test</scope> |
Comment on lines
+155
to
+160
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>io.jsonwebtoken</groupId> | ||
| <artifactId>jjwt-jackson</artifactId> | ||
| <scope>test</scope> |
Comment on lines
+56
to
+76
| private final CommonConfig config = CommonDescriptor.getInstance().getConfig(); | ||
| private PrivateKey privateKey; | ||
| private JSONObject publicJwk; | ||
|
|
||
| @Before | ||
| public void setUp() throws Exception { | ||
| KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); | ||
| keyPairGenerator.initialize(2048); | ||
| KeyPair keyPair = keyPairGenerator.generateKeyPair(); | ||
| privateKey = keyPair.getPrivate(); | ||
| publicJwk = | ||
| new JSONObject( | ||
| new RSAKey.Builder((RSAPublicKey) keyPair.getPublic()) | ||
| .keyUse(KeyUse.SIGNATURE) | ||
| .keyID("datanode-openid-test-key") | ||
| .build() | ||
| .toJSONObject()); | ||
| } | ||
|
|
||
| @After | ||
| public void tearDown() throws IOException {} |
Comment on lines
+237
to
+241
| byte[] response = json.getBytes(java.nio.charset.StandardCharsets.UTF_8); | ||
| exchange.getResponseHeaders().set("Content-Type", "application/json"); | ||
| exchange.sendResponseHeaders(200, response.length); | ||
| try (OutputStream outputStream = exchange.getResponseBody()) { | ||
| outputStream.write(response); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.