CalvinKirs opened a new pull request, #69714:
URL: https://github.com/apache/doris/pull/69714
### What problem does this PR solve?
Related PR: #63068
MySQL Connector/J can send an `authentication_openid_connect_client` payload
containing the capability byte, a length-encoded JWT, and trailing zero
padding. On branch-4.1, `MysqlAuthPacketCredentialExtractor` requires that no
bytes remain after the token. It therefore passes the entire encoded payload to
the authentication plugin and a valid token fails with `OIDC access token
signature validation failed`.
Extract the padding fix already included in master by #63068 into a
standalone branch-4.1 change. Accept trailing zero bytes while preserving the
existing handling of non-zero trailing data. Add coverage for a token longer
than 255 bytes with the six padding bytes produced by Connector/J, and for a
non-zero byte following zero padding.
### Release note
Fix OIDC JDBC login failures caused by trailing zero padding in MySQL
Connector/J authentication payloads.
### Check List (For Author)
- Test:
- [x] Unit Test: 57 MySQL protocol/authentication tests passed, with
zero failures/errors/skips. The new padding test fails before the fix. FE core
Checkstyle: zero violations.
- [ ] Regression test
- [x] Manual test: 12/12 checks passed against the FE built from this
branch, a 4.1.3 BE, and the existing Keycloak fixture with the stock OIDC
plugin.
- Unmodified Connector/J 9.4.0 and 9.6.0: OIDC login over TLS 1.3
and two consecutive queries on the same connection succeeded.
- A token file ending in a newline also succeeded with Connector/J
9.6.0.
- Invalid signatures (both drivers), a mismatched username, disabled
TLS, and a missing token were rejected.
- Native password login with Connector/J 8.4.0/9.6.0 and MySQL Shell
9.5 valid/invalid token checks passed.
- FE compiled and packaged using `build.sh --fe` with UI disabled. For
local packaging only, the BE/Cloud native dependency bootstrap was scoped to
BE/Cloud because this host lacks Paimon native artifacts; the build script was
restored and is not part of this PR.
- Behavior changed:
- [x] Yes. OIDC JDBC payloads with zero padding now yield the original
token; non-zero trailing data is not discarded.
- Does this need documentation?
- [x] No.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
