[Enhancement](http)Add http authentication to all API interfaces under be 8040.#39577
Merged
morningman merged 3 commits intoapache:masterfrom Aug 23, 2024
Merged
[Enhancement](http)Add http authentication to all API interfaces under be 8040.#39577morningman merged 3 commits intoapache:masterfrom
morningman merged 3 commits intoapache:masterfrom
Conversation
|
Thank you for your contribution to Apache Doris. Since 2024-03-18, the Document has been moved to doris-website. |
Contributor
Author
|
run buildall |
TPC-H: Total hot run time: 38235 ms |
TPC-DS: Total hot run time: 190943 ms |
ClickBench: Total hot run time: 32.02 s |
Contributor
Author
|
run buildall |
TPC-H: Total hot run time: 38549 ms |
TPC-DS: Total hot run time: 191411 ms |
ClickBench: Total hot run time: 31.7 s |
hubgeter
force-pushed
the
enable_be_http_auth
branch
from
88969e7 to
7557f21
Compare
hubgeter
force-pushed
the
enable_be_http_auth
branch
from
7557f21 to
9877411
Compare
Contributor
Author
|
run buildall |
Contributor
|
clang-tidy review says "All clean, LGTM! 👍" |
hubgeter
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| ASSERT_TRUE(check_result(input_G, output_G)); | ||
| } | ||
|
|
||
| TEST_F(HttpClientTest, enable_http_auth) { |
Contributor
There was a problem hiding this comment.
warning: function 'TEST_F' exceeds recommended size/complexity thresholds [readability-function-size]
TEST_F(HttpClientTest, enable_http_auth) {
^Additional context
be/test/http/http_client_test.cpp:347: 194 lines including whitespace and comments (threshold 80)
TEST_F(HttpClientTest, enable_http_auth) {
^
TPC-H: Total hot run time: 38288 ms |
TPC-DS: Total hot run time: 191574 ms |
ClickBench: Total hot run time: 30.75 s |
Contributor
Author
|
run buildall |
TPC-H: Total hot run time: 38190 ms |
TPC-DS: Total hot run time: 191161 ms |
ClickBench: Total hot run time: 30.73 s |
github-actions
Bot
added
the
approved
Contributor
|
PR approved by at least one committer and no changes requested. |
Contributor
|
PR approved by anyone and no changes requested. |
zy-kkk
approved these changes
Aug 23, 2024
dataroaring
pushed a commit
that referenced
this pull request
Aug 26, 2024
…r be 8040. (#39577) Add http authentication to all API interfaces under be 8040 The `enable_all_http_auth parameter` in be.conf can control the switch.
morningman
pushed a commit
that referenced
this pull request
Aug 29, 2024
## Proposed changes before pr #39577
hubgeter
added a commit
to hubgeter/doris
that referenced
this pull request
Aug 29, 2024
## Proposed changes before pr apache#39577
yiguolei
pushed a commit
that referenced
this pull request
Aug 29, 2024
dataroaring
pushed a commit
that referenced
this pull request
Sep 3, 2024
## Proposed changes before pr #39577
Closed
16 tasks
morningman
added a commit
that referenced
this pull request
Nov 12, 2024
### What problem does this PR solve? Related PR: #39577 Problem Summary: In #39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
github-actions Bot
pushed a commit
that referenced
this pull request
Nov 12, 2024
### What problem does this PR solve? Related PR: #39577 Problem Summary: In #39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
zzzxl1993
pushed a commit
to zzzxl1993/doris
that referenced
this pull request
Nov 12, 2024
### What problem does this PR solve? Related PR: apache#39577 Problem Summary: In apache#39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
py023
pushed a commit
to py023/doris
that referenced
this pull request
Nov 13, 2024
### What problem does this PR solve? Related PR: apache#39577 Problem Summary: In apache#39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Add http authentication to all API interfaces under be 8040
The
enable_all_http_auth parameterin be.conf can control the switch.Issue Number: close #xxx