branch-3.1: [feat](Authenticator) Pluginization of Authenticator (#40113) #52481
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## abstract
introduces the pluginization of the Authenticator component, enabling
greater flexibility and modularity within the authentication system. By
refactoring the Authenticator into a pluggable SPI (Service Provider
Interface), we allow for custom authentication mechanisms to be
seamlessly integrated and managed.
## Key Changes
AuthenticatorFactory Interface:
This interface defines the create method, which is used to create an
Authenticator instance based on initialization properties, enabling
support for various authentication mechanisms.
The factoryIdentifier method provides an identifier for the factory,
allowing differentiation between various AuthenticatorFactory
implementations (e.g., LDAP, default).
Implemented Specific Authentication Factories:
We have implemented factories for different authentication mechanisms
(such as LDAP), providing the necessary configuration support for each.
## eg
In your Maven pom.xml, add the fe-core dependency:
```
<dependency>
<groupId>org.apache.doris</groupId>
<artifactId>fe-core</artifactId>
<version>1.2-SNAPSHOT</version>
<scope>provided</scope>
</dependency>
```
```
import org.apache.doris.common.ConfigBase;
public class LocalAuthenticatorFactory implements AuthenticatorFactory {
@OverRide
public LocalAuthenticator create(Properties initProps) {
return new LocalAuthenticator();
}
@OverRide
public String factoryIdentifier() {
return "local";
}
}
import java.util.HashMap;
import java.util.Map;
public class LocalAuthenticator implements Authenticator {
private Map<String, String> userStore = new HashMap<>();
public LocalAuthenticator() {
// Hardcoded usernames and passwords
userStore.put("user1", "password1");
userStore.put("user2", "password2");
userStore.put("admin", "adminpass");
}
@OverRide
public boolean authenticate(String username, String password) {
// Authenticate by checking the hardcoded user store
String storedPassword = userStore.get(username);
return storedPassword != null && storedPassword.equals(password);
}
}
```
To integrate with the SPI (Service Provider Interface) mechanism, we
created a file at
**src/main/resources/META-INF/services/org.apache.doris.mysql.authenticate.AuthenticatorFactory**
containing **org.example.LocalAuthenticatorFactory,** which allows the
system to dynamically load and utilize the LocalAuthenticatorFactory
implementation.
Your plugin needs to include all necessary dependencies, and it is
generally recommended to package them into an Uber JAR (also known as a
Fat JAR) to ensure that the plugin can run independently without
additional dependency management. Once packaged, this JAR can be placed
directly in the **fe/custom_lib** directory.
(cherry picked from commit 119ea59)
### What problem does this PR solve? The `defaultAuthenticator` is not initialized. When a configured authentication plugin implements the `canDea`l method and returns `false`, the `defaultAuthenticator` will be used, resulting in a login failure. The client exception message is `RROR 2013 (HY000): Lost connection to MySQL server at 'reading authorization packet', system error: 2`. This issue only affects users who use non-built-in authentication plugins that implement `canDeal` and return false under certain circumstances. apache#40113 introduced this issue (cherry picked from commit dd0c2d8)
Contributor
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
Member
Author
|
run buildall |
Member
Author
|
run external |
morrySnow
approved these changes
Jul 1, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#40113 #40750