[feat][ws] Use async auth method to support OIDC #20238
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
michaeljmarshall
added
area/websocket
doc-not-needed
Codecov Report
@@ Coverage Diff @@
## master #20238 +/- ##
=============================================
+ Coverage 33.17% 72.92% +39.74%
- Complexity 12236 31961 +19725
=============================================
Files 1499 1868 +369
Lines 114413 138597 +24184
Branches 12431 15247 +2816
=============================================
+ Hits 37962 101069 +63107
+ Misses 71499 29483 -42016
- Partials 4952 8045 +3093
Flags with carried forward coverage won't be shown. Click here to find out more.
|
mattisonchao
reviewed
May 8, 2023
| @@ -171,20 +172,26 @@ public String authenticateHttpRequest(HttpServletRequest request, Authentication | |||
| authData = authenticationState.getAuthDataSource(); | |||
| } | |||
| // Backward compatible, the authData value was null in the previous implementation | |||
| return providerToUse.authenticate(authData); | |||
| return providerToUse.authenticateAsync(authData).get(); | |||
There was a problem hiding this comment.
Can we give it a timeout by any chance?
mattisonchao
reviewed
May 8, 2023
| LOG.debug("Authentication failed for provider " + providerToUse.getAuthMethodName() + " : " | ||
| + e.getMessage(), e); | ||
| } | ||
| throw new RuntimeException(e); |
There was a problem hiding this comment.
I am unsure who will use it. Should we consider remark interrupted in the current Thread?
mattisonchao
approved these changes
May 8, 2023
michaeljmarshall
added a commit
to datastax/pulsar
that referenced
this pull request
May 8, 2023
Fixes apache#20236 PIP: apache#19409 ### Motivation In the `AuthenticationService`, we are currently using the deprecated `authenticate` methods. As a result, we hit the `Not Implemented` exception when using the `AuthenticationProviderOpenID`. This PR updates the implementation so that we're able This solution isn't ideal for two reasons. 1. We are not using the `authenticationHttpRequest` method, which seems like the right method for the WebSocket proxy. However, this is not a viable option, as I documented in apache#20237. 2. We are calling `.get()` on a future. However, it is expected that the `AuthenticationProvider` not block forever, so I think this is acceptable for now. Please let me know if you disagree. ### Modifications * Replace `authenticate` with `authenticateAsync`. ### Verifying this change This change is a trivial rework / code cleanup without any test coverage. ### Documentation - [x] `doc-not-needed` Note that I do have documentation showing that 3.0.x does not support OIDC in the WebSocket Proxy. The `next` docs don't need that limitation since this PR fixes that and targets 3.1.0. apache/pulsar-site#558 ### Matching PR in forked repository PR in forked repository: skipping for this trivial PR (cherry picked from commit 03dc3db)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #20236
PIP: #19409
Motivation
In the
AuthenticationService, we are currently using the deprecatedauthenticatemethods. As a result, we hit theNot Implementedexception when using theAuthenticationProviderOpenID. This PR updates the implementation so that we're ableThis solution isn't ideal for two reasons.
authenticationHttpRequestmethod, which seems like the right method for the WebSocket proxy. However, this is not a viable option, as I documented in Determine Correct Expansion of AuthenticationProvider interface for WebSocket Proxy #20237..get()on a future. However, it is expected that theAuthenticationProvidernot block forever, so I think this is acceptable for now. Please let me know if you disagree.Modifications
authenticatewithauthenticateAsync.Verifying this change
This change is a trivial rework / code cleanup without any test coverage.
Documentation
doc-not-neededNote that I do have documentation showing that 3.0.x does not support OIDC in the WebSocket Proxy. The
nextdocs don't need that limitation since this PR fixes that and targets 3.1.0. apache/pulsar-site#558Matching PR in forked repository
PR in forked repository: skipping for this trivial PR