Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Evict user from auth-cache on reset password #3407

Merged
merged 11 commits into from
May 24, 2022
Merged

Evict user from auth-cache on reset password #3407

Changes from 2 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
1a30b6f
Evict user from auth-cache on reset password design
idanovo May 22, 2022
b4d0bcf
Update design/open/evict-user-from-auth-cache-on-reset-password.md
idanovo May 22, 2022
35bd2cd
Update design/open/evict-user-from-auth-cache-on-reset-password.md
idanovo May 22, 2022
9ddb9a7
Fixed tesxt
idanovo May 22, 2022
4578540
Not using auth cache for email authentication
idanovo May 23, 2022
f6fcc28
Split authenticator to middleware and controller authenticators
idanovo May 23, 2022
2e2c78f
Merge from master
idanovo May 23, 2022
a591e2a
Fix tests
idanovo May 23, 2022
75a7b1c
Merge branch 'master' of https://github.com/treeverse/lakeFS into 340…
idanovo May 23, 2022
b578190
Removed unused method from cache interface
idanovo May 23, 2022
44bc2a4
Moved design to accepted
idanovo May 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions design/open/evict-user-from-auth-cache-on-reset-password.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
## The problem:
When a user logs in to lakeFS we save their credentials in the auth-cache.
This way, we avoid checking the usr credentials through the DB on each call the user makes.
Currently, when a user tries to reset his password, his old password is still stored in the auth-cache, so he has to wait till it is evicted to log in using the new password.
idanovo marked this conversation as resolved.
Show resolved Hide resolved


## The suggested solution:
The intuitive solution is just to evict the user from the auth cache when resetting his password.
The problem with this solution is that we might not necessarily have a centralized cache, so we might need to evict the user for every auth cache he exists in.
This is why the simpler solution here might be just to not use auth cache for email-password authentication.
This way, we still won't need to authenticate when a user uses API calls that use access-key and secret for authentication and won't need to do the effort of evicting the user auth from all the auth cache instances.
In case we decide to go with this solution, we have to enable email/password authentication only through the UI.
Otherwise, user might try to use email/password authentication with our Python/Java client and won't have their credentials cached.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And why is that so bad?
We already state in the docs that email+password should be used only for the UI.
If the user decides to use them for the API, an extra DB call will happen for every request - I think it will not cause a bottleneck. If it does in the future - we can solve it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Think of a Spark app reading from multiple workers. One user in one org makes a mistake, and all users get rate limited.

A shared auth server will have this problem in trumps, even more so if it fails to protect its DB access.