database/doris
2
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

[fix](auth) fix overwrite logic of user with domain (#27002)

Browse Source 
Reproduce:
DBA do following operations:
1. create user user1@['domain'];   // the domain will be resolved as 2 ip: ip1 and ip2;
2. create user user1@'ip1';
3. wait at least 10 second
4. grant all on *.*.* to user1@'ip1';  // will return error: user1@'ip1' does not exist

This is because the daemon thread DomainResolver resolve the "domain" and overwrite the `user1@'ip1'`
which is created by DBA.

This PR fix it.
This commit is contained in:
Mingyu Chen
2023-11-15 18:19:54 +08:00
committed by GitHub
parent d3fd923447
commit 52d7725b36
3 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Auth.java
View File

@ -453,7 +453,7 @@ public class Auth implements Writable {
// create user
try {
//we should not throw AnalysisException at here,so transfer it
// we should not throw AnalysisException at here,so transfer it
userManager.createUser(userIdent, password, null, false);
} catch (PatternMatcherException e) {
throw new DdlException("create user failed,", e);

6
fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/UserManager.java
View File

@ -183,6 +183,12 @@ public class UserManager implements Writable {
throws PatternMatcherException {
if (userIdentityExist(userIdent, true)) {
User userByUserIdentity = getUserByUserIdentity(userIdent);
if (!userByUserIdentity.isSetByDomainResolver() && setByResolver) {
// If the user is NOT created by domain resolver,
// and the current operation is done by DomainResolver,
// we should not override it, just return
return userByUserIdentity;
}
userByUserIdentity.setPassword(pwd);
userByUserIdentity.setSetByDomainResolver(setByResolver);
return userByUserIdentity;

32
fe/fe-core/src/test/java/org/apache/doris/mysql/privilege/AuthTest.java
View File

@ -1470,6 +1470,38 @@ public class AuthTest {
e.printStackTrace();
Assert.fail();
}
// test domain override
// 1. create a domain user
new Expectations() {
{
ctx.getCurrentUserIdentity();
minTimes = 1;
result = UserIdentity.ROOT;
}
};
UserIdentity domainUser = new UserIdentity("test_domain_user", "palo.domain1", true);
userDesc = new UserDesc(domainUser, "12345", true);
createUserStmt = new CreateUserStmt(false, userDesc, null);
createUserStmt.analyze(analyzer);
auth.createUser(createUserStmt);
// 2. create a normal user with same ip in domain
UserIdentity normalUser = new UserIdentity("test_domain_user", "10.1.1.1");
userDesc = new UserDesc(normalUser, "12345", true);
createUserStmt = new CreateUserStmt(false, userDesc, null);
createUserStmt.analyze(analyzer);
auth.createUser(createUserStmt);
// 3. run resolve
resolver.runAfterCatalogReady();
// 4. user grant to test that normal user is not overwrite by domain resolve
grantStmt = new GrantStmt(normalUser, null, new TablePattern("*", "*", "*"), privileges);
try {
grantStmt.analyze(analyzer);
auth.grant(grantStmt);
} catch (UserException e) {
e.printStackTrace();
Assert.fail();
}
}
@Test