[fix](auth)fix when authentication, the permissions of multiple roles should be merged #52349

zddr · 2025-06-26T07:27:24Z

What problem does this PR solve?

when user1 has two role: role1 and role2

role1 has priv1

role2 has priv2

when user1 needs both priv1 and priv2 for authorization

expect behavior：

Authentication successful

Current system behavior：

the system will throw a 'Permission Denied' error."

Fix Solution：

When validating permissions via the second role, retain awareness of privileges assigned to the first role

Issue Number: close #xxx

Related PR: #xxx

Problem Summary:

Release note

None

Check List (For Author)

Test
- Regression test
- Unit Test
- Manual test (add detailed scripts or steps below)
- No need to test or manual test. Explain why:
  - This is a refactor/code format and no logic has been changed.
  - Previous test can cover this change.
  - No code files have been changed.
  - Other reason
Behavior changed:
- No.
- Yes.
Does this need documentation?
- No.
- Yes.

Check List (For Reviewer who merge this PR)

Confirm the release note
Confirm test cases
Confirm document
Add branch pick label

hello-stephen · 2025-06-26T07:27:29Z

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

What problem was fixed (it's best to include specific error reporting information). How it was fixed.
Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
What features were added. Why was this function added?
Which code was refactored and why was this part of the code refactored?
Which functions were optimized and what is the difference before and after the optimization?

zddr · 2025-06-26T07:29:38Z

run buildall

morrySnow

add ut

hello-stephen · 2025-06-26T08:48:53Z

FE UT Coverage Report

Increment line coverage 50.00% (11/22) 🎉
Increment coverage report
Complete coverage report

zddr · 2025-06-26T10:42:41Z

run buildall

zddr · 2025-06-26T11:07:46Z

run buildall

doris-robot · 2025-06-26T11:25:48Z

TPC-H: Total hot run time: 34411 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit e2cebe817399556ac0dced0fc27c6af4fe62f794, data reload: false

------ Round 1 ----------------------------------
q1	17634	5165	5039	5039
q2	1956	291	196	196
q3	10518	1317	758	758
q4	10277	1014	526	526
q5	8160	2413	2321	2321
q6	188	167	126	126
q7	901	733	608	608
q8	9323	1284	1120	1120
q9	6859	5179	5190	5179
q10	6932	2390	1982	1982
q11	497	305	284	284
q12	351	359	247	247
q13	17784	3753	3138	3138
q14	240	240	212	212
q15	557	481	489	481
q16	434	433	403	403
q17	642	858	392	392
q18	7586	7258	7180	7180
q19	1626	971	553	553
q20	365	367	228	228
q21	4007	3249	2467	2467
q22	1066	1039	971	971
Total cold run time: 107903 ms
Total hot run time: 34411 ms

----- Round 2, with runtime_filter_mode=off -----
q1	5171	5026	5053	5026
q2	253	324	222	222
q3	2160	2621	2302	2302
q4	1402	1809	1354	1354
q5	4339	4321	4439	4321
q6	217	169	127	127
q7	1959	1915	1785	1785
q8	2596	2591	2544	2544
q9	7192	7267	7215	7215
q10	3082	3271	2878	2878
q11	579	505	501	501
q12	698	796	618	618
q13	3596	4003	3332	3332
q14	276	296	267	267
q15	528	484	475	475
q16	449	496	425	425
q17	1118	1441	1409	1409
q18	7534	7079	6945	6945
q19	811	766	853	766
q20	1943	1988	1840	1840
q21	4841	4413	4450	4413
q22	1093	1054	994	994
Total cold run time: 51837 ms
Total hot run time: 49759 ms

doris-robot · 2025-06-26T11:37:32Z

TPC-DS: Total hot run time: 187728 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit e2cebe817399556ac0dced0fc27c6af4fe62f794, data reload: false

query1	1015	403	402	402
query2	6563	1829	1808	1808
query3	6737	230	222	222
query4	26292	23907	22945	22945
query5	4369	599	460	460
query6	307	221	200	200
query7	4625	515	306	306
query8	262	231	238	231
query9	8639	2873	2855	2855
query10	485	355	282	282
query11	15785	14997	14777	14777
query12	156	118	104	104
query13	1658	554	428	428
query14	9462	5765	5904	5765
query15	216	188	178	178
query16	7521	639	494	494
query17	1212	734	599	599
query18	2035	420	311	311
query19	203	208	170	170
query20	127	126	125	125
query21	218	124	117	117
query22	4120	4295	4136	4136
query23	33946	33143	33339	33143
query24	8581	2427	2483	2427
query25	555	510	443	443
query26	818	279	163	163
query27	2735	522	365	365
query28	4308	2313	2283	2283
query29	763	588	453	453
query30	290	222	194	194
query31	917	855	743	743
query32	73	68	62	62
query33	558	376	335	335
query34	866	871	558	558
query35	779	834	733	733
query36	1011	996	942	942
query37	115	98	76	76
query38	4115	4190	4046	4046
query39	1522	1418	1432	1418
query40	210	116	111	111
query41	64	55	52	52
query42	132	114	114	114
query43	553	554	531	531
query44	1420	913	900	900
query45	180	175	165	165
query46	896	1042	665	665
query47	1779	1832	1704	1704
query48	397	438	342	342
query49	722	483	404	404
query50	676	735	430	430
query51	4139	4214	4067	4067
query52	129	109	107	107
query53	244	268	212	212
query54	608	607	544	544
query55	87	85	90	85
query56	315	305	292	292
query57	1182	1204	1114	1114
query58	267	268	271	268
query59	2834	2823	2793	2793
query60	342	325	328	325
query61	129	132	148	132
query62	803	727	643	643
query63	232	195	199	195
query64	3482	1053	694	694
query65	4221	4161	4194	4161
query66	933	419	367	367
query67	15885	15903	15532	15532
query68	8726	964	589	589
query69	480	320	281	281
query70	1245	1214	1155	1155
query71	464	351	315	315
query72	5514	4814	4814	4814
query73	725	631	379	379
query74	8938	9024	9115	9024
query75	4143	3210	2822	2822
query76	3584	1169	756	756
query77	805	459	318	318
query78	9905	10222	9333	9333
query79	1700	865	613	613
query80	657	540	457	457
query81	479	270	222	222
query82	243	134	99	99
query83	295	269	245	245
query84	292	112	92	92
query85	759	415	334	334
query86	335	317	292	292
query87	4421	4531	4416	4416
query88	3078	2469	2459	2459
query89	388	321	297	297
query90	2096	212	213	212
query91	144	142	120	120
query92	76	62	58	58
query93	1135	1011	661	661
query94	676	408	318	318
query95	395	304	304	304
query96	538	598	303	303
query97	2716	2750	2690	2690
query98	235	224	210	210
query99	1425	1379	1292	1292
Total cold run time: 273432 ms
Total hot run time: 187728 ms

doris-robot · 2025-06-26T11:42:51Z

ClickBench: Total hot run time: 29.48 s

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit e2cebe817399556ac0dced0fc27c6af4fe62f794, data reload: false

query1	0.04	0.04	0.04
query2	0.08	0.04	0.05
query3	0.25	0.08	0.07
query4	1.60	0.11	0.11
query5	0.45	0.45	0.42
query6	1.20	0.65	0.67
query7	0.03	0.02	0.02
query8	0.05	0.04	0.04
query9	0.62	0.54	0.54
query10	0.58	0.58	0.58
query11	0.16	0.12	0.11
query12	0.16	0.12	0.12
query13	0.62	0.61	0.62
query14	0.82	0.81	0.82
query15	0.91	0.88	0.88
query16	0.40	0.39	0.41
query17	1.10	1.07	1.06
query18	0.25	0.23	0.22
query19	1.98	1.85	1.88
query20	0.02	0.01	0.01
query21	15.37	0.92	0.58
query22	0.78	1.16	0.63
query23	14.97	1.40	0.70
query24	6.86	2.39	0.34
query25	0.31	0.20	0.13
query26	0.60	0.18	0.14
query27	0.06	0.05	0.05
query28	9.84	0.94	0.45
query29	12.56	4.05	3.42
query30	0.25	0.09	0.07
query31	2.86	0.61	0.40
query32	3.23	0.57	0.47
query33	3.09	3.06	3.05
query34	16.11	5.42	4.79
query35	4.90	4.83	4.93
query36	0.70	0.51	0.49
query37	0.09	0.07	0.07
query38	0.05	0.04	0.03
query39	0.04	0.03	0.03
query40	0.18	0.14	0.14
query41	0.09	0.03	0.03
query42	0.03	0.03	0.03
query43	0.04	0.04	0.04
Total cold run time: 104.33 s
Total hot run time: 29.48 s

hello-stephen · 2025-06-26T12:07:11Z

FE UT Coverage Report

Increment line coverage 50.00% (11/22) 🎉
Increment coverage report
Complete coverage report

github-actions · 2025-06-30T04:16:16Z

PR approved by at least one committer and no changes requested.

github-actions · 2025-06-30T04:16:19Z

PR approved by anyone and no changes requested.

zfr9527

LGTM

… should be merged (apache#52349) ### What problem does this PR solve? when user1 has two role: role1 and role2 role1 has priv1 role2 has priv2 when user1 needs both priv1 and priv2 for authorization **expect behavior**： Authentication successful **Current system behavior**： the system will throw a 'Permission Denied' error." **Fix Solution**： When validating permissions via the second role, retain awareness of privileges assigned to the first role

… should be merged (apache#52349) ### What problem does this PR solve? when user1 has two role: role1 and role2 role1 has priv1 role2 has priv2 when user1 needs both priv1 and priv2 for authorization **expect behavior**： Authentication successful **Current system behavior**： the system will throw a 'Permission Denied' error." **Fix Solution**： When validating permissions via the second role, retain awareness of privileges assigned to the first role # Conflicts: # fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Auth.java # fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java # fe/fe-core/src/test/java/org/apache/doris/mysql/privilege/AuthTest.java # fe/fe-core/src/test/java/org/apache/doris/utframe/TestWithFeService.java

… should be merged (apache#52349) ### What problem does this PR solve? when user1 has two role: role1 and role2 role1 has priv1 role2 has priv2 when user1 needs both priv1 and priv2 for authorization **expect behavior**： Authentication successful **Current system behavior**： the system will throw a 'Permission Denied' error." **Fix Solution**： When validating permissions via the second role, retain awareness of privileges assigned to the first role # Conflicts: # fe/fe-core/src/test/java/org/apache/doris/mysql/privilege/AuthTest.java # fe/fe-core/src/test/java/org/apache/doris/utframe/TestWithFeService.java

… should be merged (apache#52349) ### What problem does this PR solve? when user1 has two role: role1 and role2 role1 has priv1 role2 has priv2 when user1 needs both priv1 and priv2 for authorization **expect behavior**： Authentication successful **Current system behavior**： the system will throw a 'Permission Denied' error." **Fix Solution**： When validating permissions via the second role, retain awareness of privileges assigned to the first role # Conflicts: # fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java # fe/fe-core/src/test/java/org/apache/doris/mysql/privilege/AuthTest.java # fe/fe-core/src/test/java/org/apache/doris/utframe/TestWithFeService.java

…ltiple roles should be merged #52349 (#52949) pick from #52349

…tiple roles… (#52948) … should be merged (#52349) pick: #52349

… should be merged (apache#52349) ### What problem does this PR solve? when user1 has two role: role1 and role2 role1 has priv1 role2 has priv2 when user1 needs both priv1 and priv2 for authorization **expect behavior**： Authentication successful **Current system behavior**： the system will throw a 'Permission Denied' error." **Fix Solution**： When validating permissions via the second role, retain awareness of privileges assigned to the first role # Conflicts: # fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Auth.java # fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java # fe/fe-core/src/test/java/org/apache/doris/mysql/privilege/AuthTest.java # fe/fe-core/src/test/java/org/apache/doris/utframe/TestWithFeService.java

…tiple roles should be merged #52349 (#52947) pick #52349

zddr added 5 commits June 26, 2025 11:59

1

78026e7

add case

77848ff

add case

f85a22b

add case

8cc1d4c

add case

cb4618f

morrySnow added p0_b dev/2.1.x dev/3.0.x dev/3.1.x labels Jun 26, 2025

morrySnow reviewed Jun 26, 2025

View reviewed changes

add ut

9ffab7b

zddr requested a review from morrySnow June 26, 2025 10:43

1

e2cebe8

morrySnow approved these changes Jun 30, 2025

View reviewed changes

github-actions bot added approved Indicates a PR has been approved by one committer. reviewed labels Jun 30, 2025

zfr9527 approved these changes Jul 2, 2025

View reviewed changes

morrySnow merged commit cae49a5 into apache:master Jul 2, 2025
27 of 28 checks passed

github-actions bot added the dev/3.0.x-conflict label Jul 2, 2025

github-actions bot added dev/2.1.x-conflict dev/3.1.x-conflict labels Jul 2, 2025

zddr mentioned this pull request Jul 8, 2025

branch-2.1:[fix](auth)fix when authentication, the permissions of multiple roles should be merged #52349 #52947

Merged

zddr mentioned this pull request Jul 8, 2025

branch-3.0:[fix](auth)fix when authentication, the permissions of multiple roles… #52948

Merged

zddr mentioned this pull request Jul 8, 2025

branch-3.1: [fix](auth)fix when authentication, the permissions of multiple roles should be merged #52349 #52949

Merged

morrySnow pushed a commit that referenced this pull request Jul 9, 2025

branch-3.1: [fix](auth)fix when authentication, the permissions of mu…

09bf917

…ltiple roles should be merged #52349 (#52949) pick from #52349

morrySnow added dev/3.1.0-merged and removed dev/3.1.x dev/3.1.x-conflict labels Jul 9, 2025

dataroaring pushed a commit that referenced this pull request Jul 9, 2025

branch-3.0:[fix](auth)fix when authentication, the permissions of mul…

e95458b

…tiple roles… (#52948) … should be merged (#52349) pick: #52349

dataroaring added dev/3.0.7-merged and removed dev/3.0.x dev/3.0.x-conflict labels Jul 9, 2025

yiguolei added dev/2.0.11-merged dev/2.1.11-merged and removed dev/2.1.x dev/2.1.x-conflict dev/2.0.11-merged labels Jul 24, 2025

yiguolei pushed a commit that referenced this pull request Jul 24, 2025

branch-2.1:[fix](auth)fix when authentication, the permissions of mul…

5873aa3

…tiple roles should be merged #52349 (#52947) pick #52349

[fix](auth)fix when authentication, the permissions of multiple roles should be merged #52349

[fix](auth)fix when authentication, the permissions of multiple roles should be merged #52349

Uh oh!

Conversation

zddr commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What problem does this PR solve?

Release note

Check List (For Author)

Check List (For Reviewer who merge this PR)

Uh oh!

hello-stephen commented Jun 26, 2025

Uh oh!

zddr commented Jun 26, 2025

Uh oh!

morrySnow left a comment

Choose a reason for hiding this comment

Uh oh!

hello-stephen commented Jun 26, 2025

FE UT Coverage Report

Uh oh!

zddr commented Jun 26, 2025

Uh oh!

zddr commented Jun 26, 2025

Uh oh!

doris-robot commented Jun 26, 2025

Uh oh!

doris-robot commented Jun 26, 2025

Uh oh!

doris-robot commented Jun 26, 2025

Uh oh!

hello-stephen commented Jun 26, 2025

FE UT Coverage Report

Uh oh!

github-actions bot commented Jun 30, 2025

Uh oh!

github-actions bot commented Jun 30, 2025

Uh oh!

zfr9527 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

zddr commented Jun 26, 2025 •

edited

Loading