Skip to content

[fix](fe) Preserve session roles in metadata authorization - #70453

Open
CalvinKirs wants to merge 4 commits into
apache:masterfrom
CalvinKirs:fix/propagate-authenticated-roles
Open

[fix](fe) Preserve session roles in metadata authorization#70453
CalvinKirs wants to merge 4 commits into
apache:masterfrom
CalvinKirs:fix/propagate-authenticated-roles

Conversation

@CalvinKirs

@CalvinKirs CalvinKirs commented Nov 11, 2026

Copy link
Copy Markdown
Member

Background

Authentication plugins can supply session roles without creating persistent user-role grants.

What problem does this PR solve?

Issue Number: None
Related PR: None
PR Type: Bugfix

Problem Summary: Users whose permissions come from other authentication plugins can query tables, but information_schema.schemata, tables and columns omit accessible objects because metadata requests lose their session roles.

For example, grant r1 SELECT on internal.db1.t1, then log in through an authentication plugin that supplies r1 as a session role without a persistent user-role grant:

SELECT k FROM db1.t1 LIMIT 1; -- authorized
SELECT table_name FROM information_schema.tables
WHERE table_schema = 'db1' AND table_name = 't1'; -- incorrectly empty

Details

  • Change map: Production +210/-48 in 20 files; tests +552/-3 in 3 files.
  • Frequency: Metadata authorization that depends on plugin-supplied session roles.
  • Root cause: RPC identities and authorization adapters retain the account but drop session roles.
  • Why existing tests missed it: Local session checks did not cross serialized metadata callbacks.
  • Fix: Reuse common local/session role resolution and carry a role snapshot through the shared RPC identity. Preserve policy scopes and keep session authority out of persistent grants and durable job owners.
  • Other paths and branches: Update schema/TVF/Flight metadata, process-list requests and FE forwarding on master. The new field is optional; full propagation requires upgraded FE and BE.
  • Behavior change: Accessible metadata now follows the same local and session roles as ordinary queries.

Testing

  • Official run-fe-ut.sh: 182 tests passed in 16 classes; FE Checkstyle passed.
  • Covers detached metadata callbacks, local plus session roles, legacy payloads, policy snapshots, job-owner replay and built-in/plugin role boundaries.
  • Native BE execution and live authentication-plugin integration were not tested.

Release note

Fix missing system metadata for users authorized through authentication-plugin session roles after upgrading FE and BE.

Check List (For Author)

  • Behavior changed: Yes (see Details)
  • Does this need documentation: No
  • Pre-submission status: Partially verified: native BE execution and live authentication-plugin integration were not tested

AI Disclosure

  • Tool: Codex
  • Generated: Code, tests and PR description
  • Human review: Pending maintainer review

@CalvinKirs
[fix](fe) Preserve session roles in metadata authorization
327a333 
### Background

Authentication integrations can grant roles for a login session without creating persistent user-role bindings.

### What problem does this PR solve?

Issue Number: None
Related PR: None
PR Type: Bugfix

Problem Summary: A user authorized by session role mapping can query a table but see no rows in information_schema.schemata, tables, or columns. Carry session roles through the shared RPC identity and reuse the existing role resolver for metadata authorization.

### Details

- **Change map:** Production +178/-42 lines in 19 files; tests +370/-2 lines in 3 files. Most sending sites change one identity snapshot call.
- **Frequency:** Metadata queries whose privileges depend on authentication-granted roles.
- **Root cause:** Schema callbacks carry the account but lose the login session roles; the authorization plugin adapter also reconstructs an account-only identity.
- **Why existing tests missed it:** Session role tests checked local authorization with a connection on the thread, without serializing the identity or checking metadata callbacks.
- **Fix:** Snapshot authentication roles in the shared identity sender, preserve them across the authorization adapter, and merge them with persistent and LDAP roles in the existing resolver. Session roles remain transient and are not persisted as grants.
- **Other paths and branches:** Update schema scans, metadata TVFs, Flight metadata requests, process-list requests, and FE forwarding on master. The optional field uses the same free id across maintained release branches. Both FE and BE must be upgraded to preserve it; older BE binaries retain the existing metadata behavior.

### Testing

- FE unit tests: 152 passed across metadata callbacks, session role transport, authentication integration / role mapping, built-in and plugin authorization, connection handling, and the frozen authorization SPI contract.
- FE Checkstyle: passed.
- No native BE build or live OIDC provider test.

### Release note

Fix missing information_schema metadata for users whose permissions come from authentication role mapping after upgrading FE and BE.

### Check List (For Author)

- Test: Unit Test
- Behavior changed: Yes (metadata authorization retains authentication-granted roles)
- Does this need documentation: No
- Pre-submission status: Partially verified: native BE and a live OIDC provider were not tested

### AI Disclosure

- Tool: Codex
- Generated: Code, tests, and commit message
- Human review: Pending maintainer review
@CalvinKirs
[fix](fe) Preserve role scope across forwarding and policy snapshots
d76822a 
### Background

Metadata authorization must retain authentication-granted roles for the request without turning them into persistent account memberships.

### What problem does this PR solve?

Issue Number: None
Related PR: None
PR Type: Bugfix

Problem Summary: Forwarded session identities can retain temporary roles as durable job creators, while captured data-policy contexts can discard those roles. Separate received session roles from account identity, preserve the role scope in policy snapshots, and keep synthetic LDAP privilege objects out of plugin role names.

### Details

- **Frequency:** Forwarded mapped-role sessions, captured policy evaluation, and legacy LDAP users with role-based plugins.
- **Root cause:** Shared account identities were used as session carriers; frozen policy contexts copied only IP/query ID; plugin role lookup exposed LDAP's synthetic information_schema role.
- **Why existing tests missed it:** They did not cross durable creator serialization, frozen role-sensitive policy contexts, or synthetic/real same-name role boundaries.
- **Fix:** Use a common RPC session receiver, compare role scopes in captured policies, and share managed local/mapped role resolution while retaining legacy LDAP privilege handling for built-in checks.
- **Other paths and branches:** Keep legacy forwarded requests role-free and preserve native-session and named-role behavior on master.

### Testing

- Official run-fe-ut.sh: 182 tests passed in 16 classes, including metadata, authentication, plugin contracts, policy snapshots, job-owner serialization and partition-policy safety.
- FE Checkstyle passed.
- No native BE build or live OIDC provider test.

### Release note

Preserve session role scope for forwarded metadata and policy checks without retaining temporary authority in account identities or exposing internal LDAP privilege roles to plugins.

### Check List (For Author)

- Test: Unit Test
- Behavior changed: Yes (correct session-role scope across metadata and policy boundaries)
- Does this need documentation: No
- Pre-submission status: Partially verified: native BE and a live OIDC provider were not tested

### AI Disclosure

- Tool: Codex
- Generated: Code, tests, and commit message
- Human review: Pending maintainer review
@hello-stephen

hello-stephen commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

run cloudut

@CalvinKirs

CalvinKirs commented Nov 12, 2026

Copy link
Copy Markdown
Member Author

run buildall

@CalvinKirs
[test](fe) Use real session contexts in Flight metadata tests
26258ff 
### Background

Flight SQL metadata requests use a shared session identity snapshot that carries authentication-plugin roles.

### What problem does this PR solve?

Issue Number: None
Related PR: None
PR Type: Test

Problem Summary: All 27 FlightSqlSchemaHelperTableTypesTest cases fail because their mocked ConnectContext only stubs the old account getter, leaving the new RPC identity snapshot null. Use a real session context and check role transport with and without returned table schemas.

### Details

- **Change map:** One test file, +36/-10; no production changes.
- **Scenarios:** Existing table-type aliases, filtering and external catalogs, plus session roles with and without table schemas.
- **What existing tests miss:** A stale mock cannot exercise the real session identity serializer or preserve roles in metadata requests.
- **Fails when broken:** The previous fixture fails all 27 cases with a null identity; added role-bearing cases fail if any database/table/column metadata request loses the role snapshot.

### Testing

- Official run-fe-ut.sh: 184 tests passed in 21 Flight SQL, session-role, metadata and authorization SPI classes, including all 29 table-type cases.
- FE Checkstyle passed.
- CI failure evidence checked against the previous commit.

### Release note

None

### Check List (For Author)

- Behavior changed: No
- Does this need documentation: No
- Pre-submission status: Ready

### AI Disclosure

- Tool: Codex
- Generated: Test change and commit message
- Human review: Pending maintainer review
@CalvinKirs

CalvinKirs commented Nov 12, 2026

Copy link
Copy Markdown
Member Author

run buildall

@CalvinKirs

CalvinKirs commented Nov 15, 2026

Copy link
Copy Markdown
Member Author

run buildall

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@morrySnow morrySnow Awaiting requested review from morrySnow morrySnow is a code owner
@924060929 924060929 Awaiting requested review from 924060929 924060929 is a code owner
@englefly englefly Awaiting requested review from englefly englefly is a code owner
@starocean999 starocean999 Awaiting requested review from starocean999 starocean999 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dev/4.1.x dev/4.2.x

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@CalvinKirs @hello-stephen