[
https://issues.apache.org/jira/browse/IMPALA-15372?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anubhav Jindal updated IMPALA-15372:
------------------------------------
Priority: Critical (was: Major)
> Improve JWT/OAuth logging and metric attribution when both legacy auth modes
> are enabled
> ----------------------------------------------------------------------------------------
>
> Key: IMPALA-15372
> URL: https://issues.apache.org/jira/browse/IMPALA-15372
> Project: IMPALA
> Issue Type: Improvement
> Reporter: Anubhav Jindal
> Assignee: Anubhav Jindal
> Priority: Critical
>
> *Background*
> In IMPALA-14799, bearer-token verification was unified via
> OAuthServersManager.
> When both legacy flags are enabled at the same time (`--jwt_token_auth=true`
> and
> `--oauth_token_auth=true`), Webserver authentication can verify the token
> correctly but still attribute success/failure metrics and some log messages
> based
> on server flag precedence rather than the actual verification path.
>
> *Problem*
> Current behavior in `be/src/util/webserver.cc` can produce misleading
> observability:
> 1) Success metric attribution can be inaccurate when both legacy modes are on.
> 2) Failure logging may report "Invalid JWT token provided" in cases where
> OAuth
> mode was also in play.
> 3) This makes operational dashboards and troubleshooting harder in mixed-mode
> deployments.
>
> *Repro (example)*
> 1) Start Impala with both legacy token auth modes enabled:
> --jwt_token_auth=true
> --oauth_token_auth=true
> (with valid jwks settings for both)
> 2) Send bearer tokens representing different providers.
> 3) Observe token auth counters/logs and compare with the actual matched
> verifier.
>
> *Expected Behavior*
> - Metrics should reflect the actual verifier/provider path used for the
> request.
> - Log messages should be provider-accurate (or explicitly generic where
> attribution is not possible).
> - Behavior should remain backward-compatible for auth success/failure
> outcomes.
>
> *Proposed Fix*
> - Extend token verification path to return provider/mode attribution metadata
> (e.g. matched legacy mode/provider identity).
> - Use returned metadata to increment the correct jwt/oauth counters.
> - Update log messages to avoid misleading provider labels.
> - Keep existing auth semantics unchanged; this is an observability correctness
> fix.
>
> *Acceptance Criteria*
> - In mixed legacy mode, successful JWT-authenticated requests increment JWT
> success counter only.
> - In mixed legacy mode, successful OAuth-authenticated requests increment
> OAuth
> success counter only.
> - Failure counters/logs align with actual verification attempts/results.
> - Existing JWT-only and OAuth-only behavior remains unchanged.
> - Targeted unit/integration tests added/updated to validate attribution and
> logs.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
