pan3793 commented on code in PR #7762:
URL: https://github.com/apache/kyuubi/pull/7762#discussion_r4134892092
##########
kyuubi-common/src/main/scala/org/apache/kyuubi/config/KyuubiConf.scala:
##########
@@ -3204,6 +3204,31 @@ object KyuubiConf {
.version("1.12.0")
.fallbackConf(ENGINE_SECURITY_CRYPTO_CIPHER_TRANSFORMATION)
+ object InternalSecurityCryptoCompatibilityMode extends Enumeration {
+ type InternalSecurityCryptoCompatibilityMode = Value
+
+ val STRICT, READ_COMPATIBLE, MIGRATE = Value
+ }
+
+ val INTERNAL_SECURITY_CRYPTO_COMPATIBILITY_MODE: ConfigEntry[String] =
+ buildConf("kyuubi.internal.security.crypto.compatibilityMode")
+ .doc("Controls internal access token compatibility. Supported values:
<ul>" +
+ "<li>STRICT: issue and accept only tokens with a prefixed random
IV.</li>" +
+ "<li>READ_COMPATIBLE: issue tokens with a prefixed random IV and
accept both token " +
+ "formats.</li>" +
+ "<li>MIGRATE: issue and accept both token formats using the legacy
static zero IV for " +
+ "issued tokens.</li>" +
+ "</ul> MIGRATE weakens token security and should only be used during a
rolling " +
+ "upgrade from Kyuubi 1.11.1 or earlier. This compatibility mode will
be removed in a " +
+ "future release.")
Review Comment:
Given that "this compatibility mode will be removed in a future release.",
let's put a `legacy` namespace in the config name, e.g.,
`kyuubi.legacy.internal.security.crypto.compatMode`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
