You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org> on 2025/08/03 22:51:36 UTC
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Mihaly Szjatinya has uploaded this change for review. ( http://gerrit.cloudera.org:8080/23237
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and improved end-to-end tests for SAML2 SSO in the webserver
Notes:
- Theoretically SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
- X-Hive-Client-Identifier should be either validated after
authentication or removed
- More corner cases should be tested
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/metrics.json
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_service.py
A tests/custom_cluster/test_saml2_sso_webserver.py
14 files changed, 1,013 insertions(+), 128 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/1
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 1
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 14:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS13, Line 38: T
> Should this be <T extends HiveSamlRelayStateInfo>?
Yes, good idea.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 14
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 30 Jan 2026 11:37:13 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 13:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS13, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS13, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS13, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@147
PS13, Line 147: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 21 Jan 2026 16:17:27 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 26:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/26/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/26/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS26, Line 20: // copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (168 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/26/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/26/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS26, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (186 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/26/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/26/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS26, Line 32: // modified version of https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (173 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/26/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS26, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (158 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 26
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 25 Jun 2026 21:10:37 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 25:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/23023/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 25
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 25 Jun 2026 21:24:23 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 7:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/21162/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 7
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Dec 2025 13:07:06 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 1:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/20018/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 1
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Sun, 03 Aug 2025 23:18:13 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 29: Code-Review+1
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 29
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 08 Sep 2026 19:00:41 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 3:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/20177/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 3
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Mon, 18 Aug 2025 13:41:53 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#4). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and improved end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
24 files changed, 1,312 insertions(+), 497 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/4
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 4
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 12:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/12/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/12/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS12, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/12/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/12/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS12, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/12/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/12/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS12, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/12/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@147
PS12, Line 147: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 12
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Sat, 17 Jan 2026 22:17:12 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#14). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
31 files changed, 1,611 insertions(+), 788 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/14
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 14
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 14:
(2 comments)
Added some high level answers for some comments by Jason, as I wrote the original hs2-http SAML2 implementation and these comments are also relevant for that.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@326
PS13, Line 326: ValidateSaml2Response
> This code eventually calls into org.pac4j.saml.sso.impl.SAML2AuthnResponseV
IMO in the webserver case the target should be always a specific coordinator (as we are interested in some specific metrics, not getting some resource where the server doesn't matter) For this reason, there shouldn't be a load balancer involved and we shouldn't see the situation described.
The original hs2-http case is different, there can be a load balancer, but it should have sticky sessions for Impala, so I also think that we should not bump to this issue. If there is a failover, then it is to client's task to retry the SAML2 auth workflow - this is likely to be simple as they are already logged into the idp in the browser.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@373
PS13, Line 373: || use_saml_
> to enforce that SAML must be used by itself
Generally there should be always another authentication besides SAML2 browser profile, as the browser profile needs human interaction via the browser, so automated processes can't use it (it is common to poll Impala's webui from software).
There are a lot of gaps in Impala's open source test coverage around authentication. In this case I think that it would be nice to test SAML2 in combination with some other auth, but not all combinations - we also don't do that for hs2-http. E.g. I didn't find any JWT + Kerberos or JWT + LDAP tests, while we do allow these combinations: https://github.com/apache/impala/blob/9220b9699fabbcf06b134a023807ce328e43a2ea/be/src/rpc/authentication.cc#L1608
Improving coverage for multiple auth methods would need some reorganization of existing auth tests, as test files are generally specific to one method and contain helper classes to set them up. It seems doable to set up an infrastructure to start Impala with any auth combination and run tests for specific methods using different combinations, but it would be significant work.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 14
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 30 Jan 2026 12:31:18 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#24). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,690 insertions(+), 804 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/24
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 24
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 22:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS22, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS22, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS22, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS22, Line 143: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 22
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 29 May 2026 15:05:14 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 27:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS27, Line 20: // copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (168 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS27, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (186 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS27, Line 32: // modified version of https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (173 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS27, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (158 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 27
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Mon, 29 Jun 2026 13:26:40 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 27: Code-Review+1
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 27
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 07 Jul 2026 22:03:41 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 27: Code-Review+1
(5 comments)
lgtm, just some minor comments
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc@564
PS27, Line 564: FLAGS_webserver_ldap_passwords_in_clear_ok
Similarly to this we should normally reject starting up is saml is enable without tls.
FLAGS_saml2_allow_without_tls_debug_only could be reused from hs2-http server to allow this during tests.
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc@1037
PS27, Line 1037: host
Do we need the host in this? My assumption is that it is either the Impala itself or something incorrect. We also use only the path part in hs2-http
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc@1067
PS27, Line 1067: ";path=/"
Why is the cooke generated with extra arg compared to other cases? Can you add a comment about that?
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS27, Line 20: // copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> line too long (168 > 90)
nit: this is no longer a copy
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS27, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> line too long (186 > 90)
"based on" would be better now
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 27
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 28 Jul 2026 18:12:00 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 4:
(10 comments)
Thanks, a lot of useful improvements.
Yes, we need to clarify this, at least to have a consistent behavior in this scope.
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@977
PS2, Line 977: tRemoteAddress(r
> Mainly a note for myself: GetRemoteAddress() does not work with ipv6 at the
Should we add ipv6 support in this scope then?
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@977
PS2, Line 977: st();
: auto request =
> Sockaddr hast function host() for this.
Thanks!
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@992
PS2, Line 992: DCHECK(!host.empty());
: request->path += host
> Can we always assume a non-empty host? Can't a client sent a http request w
Yes, browsers are required to include it from HTTP/1.1 on. We can just return Unauthorized instead of DCHECK though.
But I don't like how path is formed either, do you see something better?
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1001
PS2, Line 1001: // Upon success sending the redirect to IDP
> Can you add a comment that the successful response is a redirect?
Ack
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1033
PS2, Line 1033: &cookie_rand_value, ";path=/");
: // pack cookie header into response
: for (const auto& h : headers) {
: auto pos = h.find(": ");
: if (pos != std::string::npos) {
:
> Can you explain and a comment about what is done here exactly?
Ack
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1093
PS2, Line 1093: _body_read should be
> !post_body_read ?
Ack
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1199
PS2, Line 1199:
> This variable looks unused, as FLAGS_webserver_max_post_length_bytes is use
Ack, it's better to use the parameter.
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py
File tests/common/impala_service.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py@82
PS1, Line 82: this t
> >But I don't see a nice way how to do this neither
Thanks, that's much better.
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py@112
PS3, Line 112: def _test_common_protocol_checks(self):
> optional: my original reason for putting this and ATTRIBUTE_STATEMENT in th
I agree, moved to bottom.
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py@177
PS3, Line 177:
: @CustomClusterTestSuite.with_args(impalad_args=SSO_ARGS, cluster_size=1)
: def test_saml2_browser_profile_no_group_filter(self):
: self._test_common_protocol_checks()
:
: @CustomClusterTestSuite.with_args(
: impalad_args=SSO_ARGS_WITH_GROUP_FILTER, cluster_size=1)
: def test_saml2_browser_profile_with_group_filter(self):
: self._test_common_group_filter_checks()
:
: def _test_saml2_browser_workflow(self, attributes_xml, expect_success):
: """ Sends the 3 SAML related requests to Impala and parses
> ImpalaTestSuite.check_connections(cls, expected_count=3) could be used for
Yeah that's a much cleaner approach. I've added some exception handling to check_connections() which seemed to be lacking.
BTW 'vector' was never even used, it was just overshadowed in for loop.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 4
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Thu, 21 Aug 2025 15:27:48 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 13:
(23 comments)
http://gerrit.cloudera.org:8080/#/c/23237/13//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/23237/13//COMMIT_MSG@31
PS13, Line 31:
Please add details on how this change was tested.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@263
PS13, Line 263: vector<string> split = Split(url, delimiter::Limit("/", 3));
Please add ctests for this function.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@277
PS13, Line 277: const string& params_string, string* err_msg) {
Please add ctests for this function.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@280
PS13, Line 280: if (key_value.size() == 2) {
What does it mean if key_value.size() is not 2? Is that an error situation that needs to be handled?
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@326
PS13, Line 326: ValidateSaml2Response
This code eventually calls into org.pac4j.saml.sso.impl.SAML2AuthnResponseValidator which checks the SAML response's "InResponseTo" field to ensure the value of that field matches the id of a SAML request that was previously created. Thus, if the SAML response is received on a different coordinator than where the SAML request was generated, this validation will fail. If that is the case, is it possible to check other coordinators to see if they issued the SAML request?
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc
File be/src/util/backend-gflag-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@174
PS13, Line 174: for HiveServer2
This help text would be more descriptive if it said something like "for client connections that use the hs2-http protocol"
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@180
PS13, Line 180: WebServer
"WebServer" is a somewhat generic term. Would it make more sense to say "debug ui" instead?
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@190
PS13, Line 190: Highserver2
hs2-http connections
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@194
PS13, Line 194: Webserver
Same question as line 180.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h
File be/src/util/webserver.h:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h@202
PS13, Line 202:
: void returnUnauthorized(
: struct sq_connection* connection);
:
: // Helper method to handle SAML authentication failure with metrics and return code
: sq_callback_result_t returnSamlAuthFailure(struct sq_connection* connection);
:
: void returnWrappedResponse(
: struct sq_connection* connection, const impala::TWrappedHttpResponse& response);
:
: sq_callback_result_t ReadPostBody(
: struct sq_connection* connection, int32_t max_length, std::string* out_body);
Please add comments to all of these functions explaining what they do.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h@329
PS13, Line 329: returnning
Nit: returning
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@373
PS13, Line 373: || use_saml_
Since this is security related, I'm not a fan of the current approach where SAML may or may not work alongside LDAP/Kerberos. We need to either test SAML in conjunction with each or else add a new entry for SAML in the AuthMode enum (defined in webserver.h) to enforce that SAML must be used by itself. My preference would be the second option since it removes attack vectors.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@851
PS13, Line 851: bool use_saml = use_saml_ && !sq_get_header(connection, "X-Impala-EETest");
This line needs to check FLAGS_saml2_ee_test_mode, otherwise SAML auth can be ignored by passing the "X-Impala-EETest" http header if another auth method is not enabled.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@87
PS13, Line 87: protected abstract String getCallBackUrl() throws Exception;
Nit: Place all the abstract methods together in the code.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@93
PS13, Line 93: protected void setRedirectCommon(WrappedWebContext webContext)
Nit: add the "final" keyword to this method so subclasses cannot override it.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@108
PS13, Line 108: public String validateAuthnResponseInner(WrappedWebContext webContext)
Nit: change to "protected" visibility and add "final" keyword
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@137
PS13, Line 137: protected <T extends HiveSamlRelayStateInfo> void validateAuthnResponseCommon(
Nit: add the "final" keyword to this method so subclasses cannot override it.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@46
PS13, Line 46: setName(ImpalaSamlClientHS2.class.getSimpleName());
: setStateGenerator(HiveSamlRelayStateStoreHS2.get());
Name and StateGenerator are set by both subclasses of ImpalaSamlClientBase. These should be set by the ImpalaSamlClientBase superclass, in its constructor, so they are not accidentally deleted or forgotten if a third subclass is created.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@53
PS13, Line 53: return BackendConfig.INSTANCE.getHS2Saml2SpCallbackUrl();
If this value will never change, then pass it to the ImpalaSamlClientBase constructor and have that class implement getCallBackUrl
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java
File fe/src/main/java/org/apache/impala/service/JniFrontend.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java@825
PS13, Line 825: Preconditions.checkNotNull(client);
Nit: client will be Null if SAML idp metadata was not configured. Pass a message that explains which startup param is missing.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java@844
PS13, Line 844: Preconditions.checkNotNull(client);
Nit: client will be Null if SAML idp metadata was not configured. Pass a message that explains which startup param is missing.
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py@145
PS13, Line 145: self._test_saml2_browser_workflow(attributes_xml, False)
Please add additional test cases using a SAML response:
* issued by an untrusted idp
* containing an expired assertion (notAfter in the past)
* containing an assertion that is not yet valid (notBefore in the future)
* containing a value for "InResponseTo" that has an invalid id
* containing a value for "InResponseTo" that matches a previous SAML response that was authenticated (in other words, a replay attack)
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py@324
PS13, Line 324: class TestWebserverSaml(TestSamlBase):
Need assertions for the "impala.webserver.total-saml-auth-success" and "impala.webserver.total-saml-auth-failure" metrics
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 30 Jan 2026 00:53:25 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#8). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
27 files changed, 1,428 insertions(+), 518 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/8
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 8
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 11:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21198/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 11
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Wed, 17 Dec 2025 12:38:12 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 21:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/21/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/21/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS21, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/21/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/21/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS21, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/21/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/21/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS21, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/21/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS21, Line 143: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 21
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 05 May 2026 11:57:04 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#12). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
31 files changed, 1,609 insertions(+), 788 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/12
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 12
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 26:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/13667/ DRY_RUN=true
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 26
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 26 Jun 2026 15:49:54 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 26:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/23024/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 26
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 25 Jun 2026 21:33:15 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#19). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
35 files changed, 2,680 insertions(+), 801 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/19
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 19
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 28:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/23900/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 28
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 02 Sep 2026 14:51:26 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#29). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,699 insertions(+), 805 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/29
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 29
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#6). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and improved end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
24 files changed, 1,315 insertions(+), 497 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/6
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 6
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 6:
(3 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/6/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/6/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS6, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/6/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/6/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@31
PS6, Line 31: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/6/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@102
PS6, Line 102: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 6
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Fri, 22 Aug 2025 14:30:33 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 13: Code-Review+1
Thanks for the changes! The change looks good to me, but I would prefer to have some extra eyes as it is security related.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 21 Jan 2026 16:27:39 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Anonymous Coward (Code Review)" <ge...@cloudera.org>.
kollar.nandor@gmail.com has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 13: Code-Review+1
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Anonymous Coward <ko...@gmail.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 21 Jan 2026 21:31:34 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 11:
(5 comments)
http://gerrit.cloudera.org:8080/#/c/23237/11//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/23237/11//COMMIT_MSG@7
PS11, Line 7: Impala
Would this work for other components than coordinator? If not than it could be mentioned that this is only for coordinator.
Actually I don't see why this couldn't work in catalog or the executor - as these are untested, it could make sense to check during startup if this is a coordinator.
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/rpc/authentication-util.cc@300
PS11, Line 300: delete response;
It seems clear to me to use and return a unique_ptr<TWrappedHttpResponse>. The original code was passing ownership with connection_context->response.reset(response); immediately - the hs2 code could release the unique_ptr while the webserver already uses it.
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/rpc/authentication-util.cc@307
PS11, Line 307: TWrappedHttpResponse* response = new TWrappedHttpResponse();
Same as line 300
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/backend-gflag-util.cc
File be/src/util/backend-gflag-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/backend-gflag-util.cc@173
PS11, Line 173: hs2_saml2_idp_metadata
There was some discussion offline and it may be better to keep the old flag name for the old configs to avoid breaking environments that set them. So my preference would be saml2_idp_metadata + webserver_saml2_idp_metadata
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc@1018
PS11, Line 1018: susccess
typo
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 11
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 13 Jan 2026 16:07:06 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 11:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/11/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/11/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS11, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/11/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/11/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS11, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/11/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/11/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS11, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/11/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@147
PS11, Line 147: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 11
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Wed, 17 Dec 2025 12:18:28 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 15:
(23 comments)
http://gerrit.cloudera.org:8080/#/c/23237/13//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/23237/13//COMMIT_MSG@31
PS13, Line 31:
> Please add details on how this change was tested.
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@263
PS13, Line 263: vector<string> split = Split(url, delimiter::Limit("/", 3));
> Please add ctests for this function.
Added.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@277
PS13, Line 277: bool ParseParams(std::map<string, string*>& params_to_check, const string& original,
> Please add ctests for this function.
Added.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@280
PS13, Line 280: vector<string> key_value = Split(pair, delimiter::Limit("=", 1));
> What does it mean if key_value.size() is not 2? Is that an error situation
It means the parameter doesn't have the standard key=value format. The code silently skips these parameters.
P.S. The function was only moved by me from authentication.cc to share it with webserver.cc
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@326
PS13, Line 326:
Thanks Csaba. I can only add that without load balancer multiple coordinators works fine for both http-hs2 and the webserver.
These two statements seems to contradict each other:
> If there is a failover, then it is to client's task to retry the SAML2 auth workflow
> The tests in test_saml2_sso.py should verify a new SAML assertion is requested if the user presents an invalid one.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc
File be/src/util/backend-gflag-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@174
PS13, Line 174: for client conn
> This help text would be more descriptive if it said something like "for cli
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@180
PS13, Line 180: debug web
> "WebServer" is a somewhat generic term. Would it make more sense to say "d
ack, maybe 'debug web UI'
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@190
PS13, Line 190:
> hs2-http connections
ack
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@194
PS13, Line 194:
> Same question as line 180.
ack
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h
File be/src/util/webserver.h:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h@202
PS13, Line 202:
: // Returns a '401 - Unauthorized' / 'AuthenticationRequired' to the client.
: void returnUnauthorized(
: struct sq_connection* connection);
:
: // Helper method to handle SAML authentication failure with metrics and return code
: sq_callback_result_t returnSamlAuthFailure(struct sq_connection* connection);
:
: // Returns a response based on a TWrappedHttpResponse that can come from Frontend code.
: void returnWrappedResponse(
: struct sq_connection* connection, const impala::TWrappedHttpResponse& response);
:
> Please add comments to all of these functions explaining what they do.
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h@329
PS13, Line 329: a before s
> Nit: returning
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@373
PS13, Line 373: || use_saml_
@Csaba, thanks for details!
> We should still test one or two of the more likely combinations (such as SAML+LDAP or SAML+Keberos).
As this would also involve the HS2, maybe we can have a different scope for this?
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@851
PS13, Line 851: bool use_saml = use_saml_ && !sq_get_header(connection, "X-Impala-EETest");
> This line needs to check FLAGS_saml2_ee_test_mode, otherwise SAML auth can
Actually the comment above is wrong here. I confused 'FLAGS_saml2_ee_test_mode' Impala flag with 'X-Impala-EETest' http header.
These are unrelated. We're checking the header here, which is sent from the bootstrap scripts based on a mandatory SAML flag.
Fixed the comment.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@87
PS13, Line 87: // 1. Validate that InResponseTo matches a request ID we actually sent
> Nit: Place all the abstract methods together in the code.
This method is not even needed.
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@93
PS13, Line 93:
> Nit: add the "final" keyword to this method so subclasses cannot override i
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@108
PS13, Line 108: WithLocationAction locationAction = (WithLocationAction) redirect.get();
> Nit: change to "protected" visibility and add "final" keyword
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@137
PS13, Line 137: return nameId;
> Nit: add the "final" keyword to this method so subclasses cannot override i
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@46
PS13, Line 46: ImpalaSamlClientHS2.class.getSimpleName(),
: HiveSamlRelayStateStoreHS2.get(),
> Name and StateGenerator are set by both subclasses of ImpalaSamlClientBase.
Good point, fixed
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@53
PS13, Line 53: throws InternalException {
> If this value will never change, then pass it to the ImpalaSamlClientBase c
Fixed
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java
File fe/src/main/java/org/apache/impala/service/JniFrontend.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java@825
PS13, Line 825: Preconditions.checkNotNull(client, "SAML client not configured. "
> Nit: client will be Null if SAML idp metadata was not configured. Pass a
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java@844
PS13, Line 844:
> Nit: client will be Null if SAML idp metadata was not configured. Pass a
Ack
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py@145
PS13, Line 145: assertation_id=str(uuid.uuid4()),
> Please add additional test cases using a SAML response:
Done. The first three are easy.
For replay attacks two security mechanisms are involved:
1. MessageReplaySecurityHandler (already in place) - automatically detects the same {msg_id} on credentialsExtractor.extract(). No changes needed for this one.
2. ImpalaSAMLMessageStore (added by me) - detects the same {request_id} as 'InResponseTo'. Once in place, also checked by credentialsExtractor.extract(). It uses the same type of cache as HiveSamlRelayStateStoreBase.
NOTE: While Webserver returns 401 upon any of the above attacks, the HS2 for some reason returns 200 and a html form, only without token. I've crafted the tests to work with this, but perhaps we could just return the same 401 here:
https://gerrit.cloudera.org/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@108
(This code is refactored but the logic is preserved)
NOTE2: I just realised that for the Webserver we're not invalidating the RelayState cache in the end of the sequence. For HS2 it is done in the end of Step 3/3. This makes the replay attack possible as Step 1 -> Step 2 -> Step 2 again.
But for Webserver if we invalidate at Step 2/2, this will not even allow us to reach credentialsExtractor.extract(), thus making replay attacks impossible.
In that case we can remove the replay attack tests for Webserver. What do you think?
cc @Chaba
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py@324
PS13, Line 324: self._test_common_protocol_checks()
> Need assertions for the "impala.webserver.total-saml-auth-success" and "imp
Good point.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 15
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Feb 2026 17:26:19 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 12:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21422/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 12
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Sat, 17 Jan 2026 23:22:24 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 26: Code-Review+1
(11 comments)
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc@326
PS22, Line 326: discard_result(
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc@336
PS22, Line 336: i
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication.cc@992
PS22, Line 992: ThriftServer::ConnectionContext* connection_context, const AuthenticationHash& hash) {
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@117
PS22, Line 117: "--webserver_require_spnego, or --webserver_saml2_sp_callback_url.");
> Done
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@355
PS22, Line 355: // excluding catalogd, statestored and impalad executors
> There was discussion on this and it was decided that it's only needed for C
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@940
PS22, Line 940:
: // Bypass LDAP/SPNEGO and SAML authentication for bootstrap health checks.
: // Restricted to localhost-only requests and monit
> Done
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS22, Line 20: // copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS22, Line 38:
> Done
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS22, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS22, Line 32: // modified version of https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS22, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
> Ack
Done
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 26
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 26 Jun 2026 15:48:02 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 29:
(5 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java:
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java@32
PS29, Line 32: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSamlAuthTokenGenerator.java
line too long (164 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS29, Line 20: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (169 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS29, Line 24: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateStore.java
line too long (170 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS29, Line 32: // based on https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (162 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/29/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS29, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (158 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 29
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 02 Sep 2026 17:17:57 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 30: Code-Review+2
thx, lookgs good to me!
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 30
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 15 Sep 2026 11:20:23 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#18). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
35 files changed, 2,708 insertions(+), 801 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/18
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 18
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 18:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/18/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/18/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS18, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/18/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/18/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS18, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/18/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/18/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS18, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/18/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS18, Line 143: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 18
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Mar 2026 13:40:37 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 10:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21197/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 10
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Wed, 17 Dec 2025 12:38:09 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#7). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
27 files changed, 1,428 insertions(+), 518 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/7
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 7
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 8:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/21163/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 8
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Dec 2025 15:50:21 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 14:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/14/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/14/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS14, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/14/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/14/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS14, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/14/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/14/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS14, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/14/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@147
PS14, Line 147: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 14
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 30 Jan 2026 11:39:12 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 26: Verified-1
Build failed: https://jenkins.impala.io/job/gerrit-verify-dryrun/13667/
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 26
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 26 Jun 2026 20:14:46 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 27:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/23049/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 27
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Mon, 29 Jun 2026 13:46:54 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 28:
(5 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java:
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java@32
PS28, Line 32: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSamlAuthTokenGenerator.java
line too long (164 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS28, Line 20: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (169 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS28, Line 24: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateStore.java
line too long (170 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS28, Line 32: // based on https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (162 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/28/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS28, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (158 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 28
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 02 Sep 2026 14:30:51 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#30). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,727 insertions(+), 830 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/30
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 30
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 30:
I merged this PR on top of https://gerrit.cloudera.org/#/c/24796/
I think we can proceed.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 30
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 15 Sep 2026 11:14:08 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 4:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@977
PS2, Line 977: tRemoteAddress(r
> Should we add ipv6 support in this scope then?
It could be a different ticket under IMPALA-13819
I have to think through how to test different authentications on ipv6 - some are tested in similar Python test, but some of it happens in Java.
Hive seems to have commits related ipv6 around SAML:
https://github.com/apache/hive/commits/master/service/src/java/org/apache/hive/service/auth/saml
We should check if some parts of this are needed in our Java code.
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@992
PS2, Line 992: DCHECK(!host.empty());
: request->path += host
> Yes, browsers are required to include it from HTTP/1.1 on. We can just retu
>We can just return Unauthorized instead of DCHECK though.
that's what I prefer - someone may forget Host by mistake or intentionally
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py
File tests/common/impala_service.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py@82
PS1, Line 82: this t
> Thanks, that's much better.
>not just the commit message.
argh, I meant coordinator
About the flags: I think that we have too many such flag plumbed through the constructor, it would be better to have a dictionary for this - this could be done in a separate patch of course
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 4
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Fri, 22 Aug 2025 08:38:03 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 6:
(3 comments)
Fixed memory management; minor refactoring.
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@977
PS2, Line 977: tRemoteAddress(r
> It could be a different ticket under IMPALA-13819
Ack, created IMPALA-14346.
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@992
PS2, Line 992: if (host.empty()) return returnSamlAuthFailure(connection);
: request->path += host
> >We can just return Unauthorized instead of DCHECK though.
Done
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py
File tests/common/impala_service.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py@82
PS1, Line 82: this t
> >not just the commit message.
Ack
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 6
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Fri, 22 Aug 2025 14:37:06 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 9:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21164/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 9
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Dec 2025 16:56:09 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 15:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/21569/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 15
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Feb 2026 18:25:15 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 16:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@326
PS13, Line 326:
> Oh, yes, those two statements are rather ambiguous. My intention was to te
Oh, ok. As clients will gradually get to adopt this, there's definitely some work on client side.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@851
PS13, Line 851: bool use_saml = use_saml_ && !sq_get_header(connection, "X-Impala-EETest");
> Ah, that is helpful. It still appears to me that any client specifying the
Hmm, we can do this only for FLAGS_saml2_ee_test_mode, but in that case we cannot start the cluster with './start-impala-cluster.py' and use it with real SAML validation.
This approach seems like a hack to me as well. Maybe it's better to skip the entire Webserver polling within '/start-impala-cluster.py' in case SAML is turned on? Or other ideas?
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py@145
PS13, Line 145: assertation_id=str(uuid.uuid4()),
> Nice tests! Thanks for adding.
Yeah, makes sense. Added the missing invalidation for Webserver and updated the tests.
Also fixed some misplaced DCHECKS, which were causing a crash on 'Invalid relay state'.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 16
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 05 Feb 2026 16:13:38 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 16:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/21581/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 16
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 05 Feb 2026 17:08:46 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 18:
(8 comments)
http://gerrit.cloudera.org:8080/#/c/23237/15/be/src/rpc/authentication-test.cc
File be/src/rpc/authentication-test.cc:
http://gerrit.cloudera.org:8080/#/c/23237/15/be/src/rpc/authentication-test.cc@516
PS15, Line 516: ASSERT_FALSE(status.ok());
> This was left out.
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@373
PS13, Line 373: || use_saml_
> Added test_webserver_auth_combined.py with testing of LDAP+SAML and SPNEGO+
The tests in `test_webserver_auth_combined.py` look great. Thanks for adding them!
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@851
PS13, Line 851: if (!authenticated && auth_mode_ == AuthMode::NONE && !use_saml_) {
> This would theoretically work with test_saml2_sso.py::TestWebserverSaml, bu
I left some comments on the code implementing this new approach.
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@356
PS18, Line 356: strcmp(google::ProgramInvocationShortName(), "impalad") == 0
The program invocation short name depends on the name of the file containing the Impala binary. We should not rely on this file to always be named "impalad". Relying on FLAGS_is_coordinator should be sufficient.
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@945
PS18, Line 945: strncmp(uri, "/jsonmetrics", 12) == 0 ||
: strncmp(uri, "/backends", 9) == 0 ||
: strncmp(uri, "/varz", 5) == 0;
Nit: please use constants instead of raw strings and numbers.
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@952
PS18, Line 952: }
I like this overall approach much better. My preference is to require the `saml2_ee_test_mode` flag to be `true` for enabling support of the "X-Impala-EETest" header. It's a simple check that shuts down an attack vector in production systems.
http://gerrit.cloudera.org:8080/#/c/23237/18/tests/custom_cluster/test_webserver_auth_combined.py
File tests/custom_cluster/test_webserver_auth_combined.py:
http://gerrit.cloudera.org:8080/#/c/23237/18/tests/custom_cluster/test_webserver_auth_combined.py@220
PS18, Line 220: # Send GET request WITHOUT Authorization header (simulates browser)
: opener = build_opener(NoRedirection)
: req = Request("http://localhost:25000/")
: response = opener.open(req)
:
: # Should get 302 redirect to SAML2 IdP, NOT 401
: assert response.getcode() == 302, \
: "Browser without auth header should redirect to SAML2, not return 401"
:
: location = response.info()["location"]
: assert TestSamlBase.IDP_URL in location, \
: "Should redirect to SAML2 IdP, got: {}".format(location)
:
: # Parse the SAML request to ensure it's valid
: relay_state, saml_req_xml = self._parse_redirection_response_common(response)
: request_id = self._parse_authn_request(saml_req_xml)
: assert request_id is not None, "Should get valid SAML AuthnRequest"
:
: # Verify SPNEGO was NOT attempted (no Authorization header = no attempt)
: impalad = self.cluster.impalads[0]
: spnego_failures = impalad.service.get_metric_value(
: "impala.webserver.total-negotiate-auth-failure")
: # May be 0 or None depending on when metric was initialized
: assert (spnego_failures is None or spnego_failures == 0), \
: "SPNEGO should not be attempted when no Authorization header present, " \
: "got {} failures".format(spnego_failures)
Nit: this code is very similar to the code in 'test_browser_fallthrough_to_saml'. Please look into refactoring this code into a generic function that can be called by both tests.
http://gerrit.cloudera.org:8080/#/c/23237/18/tests/custom_cluster/test_webserver_auth_combined.py@256
PS18, Line 256: # Send GET request WITH Authorization: Negotiate header (explicit choice)
: opener = build_opener(NoRedirection)
: req = Request("http://localhost:25000/")
:
: # Add Authorization: Negotiate header with invalid token
: # Using a dummy base64 token that will fail SPNEGO validation
: invalid_token = base64.b64encode(b"invalid_spnego_token").decode('ascii')
: req.add_header("Authorization", "Negotiate {}".format(invalid_token))
:
: # Expect 401, not 302 redirect
: try:
: response = opener.open(req)
: status_code = response.getcode()
: response_body = response.read().decode('utf-8')
: except HTTPError as e:
: status_code = e.code
: response_body = e.read().decode('utf-8')
:
: # Should get 401, NOT 302 redirect to SAML2
: assert status_code == 401, \
: "Explicit Negotiate auth failure should return 401, got {}".format(status_code)
:
: # Response should NOT be a redirect to SAML2
: # SPNEGO returns "Not authorized: Invalid token was supplied" for invalid tokens
: assert "Not authorized" in response_body, \
: "Should get SPNEGO auth failure message, not SAML2 redirect"
:
: # Verify SPNEGO failure metric incremented
: impalad = self.cluster.impalads[0]
: spnego_failures = impalad.service.get_metric_value(
: "impala.webserver.total-negotiate-auth-failure")
: assert spnego_failures >= 1, \
: "SPNEGO failure metric should increment for Negotiate auth, got {}".format(
: spnego_failures)
Nit: this code is very similar to the code in 'test_explicit_basic_auth_no_fallthrough'. Please look into refactoring this code into a generic function that can be called by both tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 18
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 05 Mar 2026 19:16:48 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 1:
(4 comments)
Looks great (and simpler than I expected)! Added a few comments, mainly high level ones. I think that it would be useful to unify more code with the hs2-http implementation to make the reviewers' work easier.
http://gerrit.cloudera.org:8080/#/c/23237/1/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/1/be/src/util/webserver.cc@930
PS1, Line 930: if (!authenticated && use_saml)
IMO this block should be done at the very end, after LDAP and Kerberos authentication - currently if both saml and Kerberos are used, we'll use SAML even if Kerberos would work based on the auth header. This would also need the LDAP/Kerberos block to be modified, as it currently expects that authentication must be either LDAP or Kerberos.
The hs2-http implementation is different in this regard as the initial request uses SAML based on the existence of header X-Hive-Token-Response-Port.
http://gerrit.cloudera.org:8080/#/c/23237/1/be/src/util/webserver.cc@1163
PS1, Line 1163: std::string Webserver::getTimeRFC1123() {
maybe reuse this somehow?
https://github.com/apache/impala/blob/a7efa7665fc113ec13a53a77efcc2d9138d44330/be/src/transport/THttpServer.cpp#L547
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py
File tests/common/impala_service.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py@82
PS1, Line 82: X-Init
I would prefer to have a more descriptive name, e.g. X-Impala-EETest
Another alternative would be to also setup JWT authentication for the SAML test and use a JWT token when we are just looking for a metric.
An even more complex alternative would be to actually use SAML2 by detecting in the test that relevant flags are set - it would be enough to do one request that gets redirected and after that we could just reuse the cookie. The benefit of this that it could increase coverage of SAML code.
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py
File tests/custom_cluster/test_saml2_sso_webserver.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py@18
PS1, Line 18:
I would highly prefer to merge this class with test_saml2_sso.py and share as many things as possible (e.g. AUTHN_RESPONSE_SCHEMA by adding a few placeholders). Besides long term maintainability it would make reviewing easier by highlighting what is new/what is different. It would also make it easier to test both having SAML2 in hs2-http and webui at the same time which is probably the most realistic scenario.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 1
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Mon, 11 Aug 2025 08:43:30 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 27:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/13671/ DRY_RUN=true
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 27
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Mon, 29 Jun 2026 13:29:03 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 21:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@952
PS18, Line 952: authenticated = true;
> Ah, I wasn't thinking of cases where start-impala-cluster.py would be used
It turns out it's not really used for production, I was wrong. Added the flag check here as well.
This has a drawback on not being able to test the real SAML flow for dev testing with this script, but hey, nothing prevents devs from turning it off locally on demand.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 21
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 05 May 2026 11:55:57 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 27: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 27
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Mon, 29 Jun 2026 17:48:54 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#25). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,690 insertions(+), 803 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/25
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 25
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 25:
(5 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS25, Line 20: // copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (168 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS25, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (186 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS25, Line 32: // modified version of https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (173 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS25, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (158 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java:
http://gerrit.cloudera.org:8080/#/c/23237/25/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java@20
PS25, Line 20: import org.apache.http.HttpStatus;
unused import: org.apache.http.HttpStatus
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 25
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 25 Jun 2026 21:02:18 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Reviewed-on: http://gerrit.cloudera.org:8080/23237
Reviewed-by: Csaba Ringhofer <cs...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,727 insertions(+), 830 deletions(-)
Approvals:
Csaba Ringhofer: Looks good to me, approved
Impala Public Jenkins: Verified
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 31
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 18:
(3 comments)
Sorry for late response. Fixed the leftovers.
http://gerrit.cloudera.org:8080/#/c/23237/15/be/src/rpc/authentication-test.cc
File be/src/rpc/authentication-test.cc:
http://gerrit.cloudera.org:8080/#/c/23237/15/be/src/rpc/authentication-test.cc@516
PS15, Line 516: ASSERT_FALSE(status.ok());
> This is a very good list of test cases. I think it would be good to add a
This was left out.
The test parser was allowing this, good catch! Fixed the function and added the testcase.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@373
PS13, Line 373: || use_saml_
> I was thinking the test would be for authenticating to the debug web ui usi
Added test_webserver_auth_combined.py with testing of LDAP+SAML and SPNEGO+SAML scenarios. These test the intelligent fallthrough scenarios, which do not require successful LDAP/SPNEGO authentication, and thus no real LDAP/SPNEGO infrastructure (which we currently have only in java fe tests).
For that I had to first fix the intelligent fallthrough itself for SPNEGO/LDAP -> SAML, which was not actually in place till now, despite the Csaba's explanation at https://gerrit.cloudera.org/c/23237/1/be/src/util/webserver.cc#930, my bad.
Now, having these combinations tested, it obviously raises the question of testing all other possible combinations, for both Webserver and HS2. I'm sure a lot of subtle bugs would come up in the process.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@851
PS13, Line 851: if (!authenticated && auth_mode_ == AuthMode::NONE && !use_saml_) {
> The open_debug_webpage function (https://gerrit.cloudera.org/c/23237/16/tes
This would theoretically work with test_saml2_sso.py::TestWebserverSaml, but not with test_webserver_auth_combined, since there we need LDAP/SPNEGO, which is mutually exclusive with basic auth. And even for the former, it would somehow make the test less precise.
However, the same idea can be implemented with pre-generated cookie, which is preemptive to any auth method. The cookie would be deleted after bootstrap is finished. This would require some work with adding a flag, etc.
For now I restricted the current approach with the X-Impala-EETest, limiting it only to localhost and to the few endpoints that are really needed.
Besides, with adding test_webserver_auth_combined I had to expand this mechanism for LDAP/SPNEGO auth as well. Refactored the code around it.
Let me know what you think.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 18
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Mar 2026 13:41:54 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 14:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@326
PS13, Line 326: ValidateSaml2Response
> IMO in the webserver case the target should be always a specific coordinato
Good point -- we don't want the user to get bounced to a different coordinator UI. The tests in test_saml2_sso.py should verify a new SAML assertion is requested if the user presents an invalid one.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@373
PS13, Line 373: || use_saml_
> > to enforce that SAML must be used by itself
I wasn't thinking about the machine use case. I agree Impala needs more work around supporting multiple auth methods, but that is far beyond the scope of this patch.
Given that use case, supporting multiple auth methods at the same time is ok with me. We should still test one or two of the more likely combinations (such as SAML+LDAP or SAML+Keberos).
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS13, Line 38: T
> Yes, good idea.
Done
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 14
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 03 Feb 2026 22:10:45 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 12:
(5 comments)
http://gerrit.cloudera.org:8080/#/c/23237/11//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/23237/11//COMMIT_MSG@7
PS11, Line 7: Coordi
> Would this work for other components than coordinator? If not than it could
Experimentally it doesn't work correctly for neither catalogd nor executors. Changing the code to disregard the flags for non-coordinators.
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/rpc/authentication-util.cc@300
PS11, Line 300: Status status = Ex
> It seems clear to me to use and return a unique_ptr<TWrappedHttpResponse>.
Good idea, ack.
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/rpc/authentication-util.cc@307
PS11, Line 307:
> Same as line 300
ack
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/backend-gflag-util.cc
File be/src/util/backend-gflag-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/backend-gflag-util.cc@173
PS11, Line 173: saml2_idp_metadata, ""
> There was some discussion offline and it may be better to keep the old flag
ok, and the same for saml2_sp_callback_url
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc@1018
PS11, Line 1018: pStatusC
> typo
ack
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 12
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Sat, 17 Jan 2026 22:15:21 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 10:
(3 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/10/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/10/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS10, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/10/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/10/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS10, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/10/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@147
PS10, Line 147: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 10
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Wed, 17 Dec 2025 12:16:13 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 19:
(5 comments)
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@356
PS18, Line 356: FLAGS_is_coordinator && !FLAGS_webserver_saml2_sp_callback_u
> The program invocation short name depends on the name of the file containin
Yeah, makes sense, since only impalad can be coordinator anyway.
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@945
PS18, Line 945: const char* uri = request_info->uri;
: const bool is_monitoring_endpoint =
: strncmp(uri, kJsonMetricsPath,
> Nit: please use constants instead of raw strings and numbers.
Ack
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@952
PS18, Line 952: check_csrf_protection = false;
> I like this overall approach much better. My preference is to require the
I may be missing something, but the problem is that this flag also skips the real SAML verification in Java code. So if we require this flag for 'start-impala-cluster' to work, the script is not going to work on production without it. And I would assume the 'start-impala-cluster' script is used also on production.
In other words, post-startup checks is not only a development-time precaution but is needed on production as well. Therefore this cannot be fixed with an impalad flag. What we need is a way for impalad's Webserver to respond differenlty to script's requests as opposed to all others.
http://gerrit.cloudera.org:8080/#/c/23237/18/tests/custom_cluster/test_webserver_auth_combined.py
File tests/custom_cluster/test_webserver_auth_combined.py:
http://gerrit.cloudera.org:8080/#/c/23237/18/tests/custom_cluster/test_webserver_auth_combined.py@220
PS18, Line 220: @classmethod
: def setup_class(cls):
: # Create the dummy keytab file - SPNEGO startup requires the file to exist
: # The file doesn't need to be a valid keytab; authentication will fail as expected
: with open(cls.KEYTAB_FILE, 'wb') as f:
: f.write(b'') # Empty file is sufficient
: super(TestWebserverSpnegoSaml2, cls).setup_class()
:
: @classmethod
: def teardown_class(cls):
: super(TestWebserverSpnegoSaml2, cls).teardown_class()
: # Clean up the dummy keytab file
: if os.path.exists(cls.KEYTAB_FILE):
: os.remove(cls.KEYTAB_FILE)
:
: def test_browser_fallthrough_to_saml(self):
: """
: Test that a browser without Authorization header falls through from SPNEGO to SAML2.
:
: When a browser accesses the webserver without credentials:
: - SPNEGO auth is skipped (no Authorization header = no explicit client choice)
: - Request falls through to SAML2
: - Client gets 302 redirect to IdP
: """
: self._assert_browser_fallthrough_to_saml(
: "impala.webserver.total-negotiate-auth-fa
> Nit: this code is very similar to the code in 'test_browser_fallthrough_to_
Ack
http://gerrit.cloudera.org:8080/#/c/23237/18/tests/custom_cluster/test_webserver_auth_combined.py@256
PS18, Line 256: self._assert_explicit_auth_no_fallthrough(
: "Negotiate", b"invalid_spnego_token",
: "Not authorized",
: "impala.webserver.total-negotiate-auth-failure")
:
: def test_complete_saml_flow_after_fallthrough(self):
: """
: Test complete SAML2 workflow after SPNEGO fallthrough.
:
: This validates that after falling through from SPNEGO:
: 1. Client gets redirect to IdP
: 2. Client can complete SAML2 authentication
: 3. Client receives authentication cookie
: """
: # Step 1: Initial request without auth header -> redirect to IdP
: relay_state, request_id = self._ws_request_resource(25000)
:
: # Step 2: Complete SAML2 authentication flow
: initial_success = self.cluster.impalads[0].service.get_metric_value(
: TestSamlBase.WS_SAML_SUCCESS_METRIC)
: initial_success = 0 if initial_success is None else initial_success
:
: attributes_xml = TestSamlBase.ATTRIBUTE_STATEMENT.format(group_name="group1")
: self._ws_send_authn_response(
: "http://localhost:25000/SAML2/SSO/POST",
: request_id, relay_state, attributes_xml, expect_success=True)
:
: # Step 3: Verify SAML2 authentication succeeded
: final_success = self.cluster.impalads[0].service.get_metric_value(
: TestSamlBase.WS_SAML_SUCCESS_METRIC)
: assert final_success == initial_success + 1, \
: "SAML success metric should increment after successful auth"
:
:
> Nit: this code is very similar to the code in 'test_explicit_basic_auth_no_
Ack
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 19
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Sun, 08 Mar 2026 22:13:43 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 19:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21891/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 19
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Sun, 08 Mar 2026 22:37:53 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 13:
(4 comments)
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/rpc/authentication.cc@979
PS12, Line 979: std::unique_ptr<TWrappedHttpResponse> response_ptr = Ge
> optional:
Agree with the 1st one, but I would keep the pointer sequence explicit IYDM, since it may get easily confusing.
Besides, the 2nd improvement would eliminate the unique_ptr declaration at all
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc@1018
PS11, Line 1018: pStatusC
> another typo :)
I think your comment is still for the previous changeset.
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/util/webserver.cc@1035
PS12, Line 1035: } else {
: returnWrappedResponse(connection, *response);
> Is it possible to get other status codes? I don't see "authenticated" being
Java sets only those 2 codes, but we can do the generic 'else' for negative case.
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/util/webserver.cc@1219
PS12, Line 1219: reserve(con
> This is not new code, but it seems better to call reserve(content_len) on o
Ack
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 21 Jan 2026 16:15:36 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 8:
(3 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/8/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/8/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS8, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/8/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/8/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS8, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/8/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@108
PS8, Line 108: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 8
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Dec 2025 15:26:27 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 22:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/22659/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 22
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 29 May 2026 15:25:52 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 24:
(11 comments)
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc@326
PS22, Line 326: discard_result(
> Unused variable "status".
Ack
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc@336
PS22, Line 336: i
> Nit: remove extra space.
Ack
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication.cc@992
PS22, Line 992: ThriftServer::ConnectionContext* connection_context, const AuthenticationHash& hash) {
> The "ValidateSaml2AuthnResponseInternal" function can return nullptr. That
Ack
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@117
PS22, Line 117: "--webserver_require_spnego, or --webserver_saml2_sp_callback_url.");
> Need to also note htpasswd cannot be used with SAML.
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@355
PS22, Line 355: // excluding catalogd, statestored and impalad executors
> Executors, catalogd, and statestored all have debug webUIs, why not include
There was discussion on this and it was decided that it's only needed for Coordinators. Updated the Jira.
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@940
PS22, Line 940:
: // Bypass LDAP/SPNEGO and SAML authentication for bootstrap health checks.
: // Restricted to localhost-only requests and monit
> These three constants need to be shared with the constants passed to the va
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS22, Line 20: // copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> Please include the exact commit hash this file was base upon.
Ack
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS22, Line 38:
> Nit: please consider renaming to HiveSamlRelayStateCacheBase only to avoid
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS22, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> Please include the exact commit hash this file was base upon.
Ack
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS22, Line 32: // modified version of https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
> Please include the exact commit hash this file was base upon.
Ack
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS22, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
> Please include the exact commit hash this file was base upon.
Ack
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 24
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 05 Jun 2026 16:53:22 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 24:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/22748/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 24
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 05 Jun 2026 17:14:46 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 30:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/14036/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 30
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 15 Sep 2026 11:20:53 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#28). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,699 insertions(+), 805 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/28
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 28
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 4:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/20221/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 4
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Thu, 21 Aug 2025 14:19:25 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 6:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/20235/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 6
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Fri, 22 Aug 2025 14:56:05 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 15:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS15, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS15, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS15, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS15, Line 143: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 15
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Feb 2026 17:28:13 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 15:
(25 comments)
http://gerrit.cloudera.org:8080/#/c/23237/13//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/23237/13//COMMIT_MSG@31
PS13, Line 31:
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/15/be/src/rpc/authentication-test.cc
File be/src/rpc/authentication-test.cc:
http://gerrit.cloudera.org:8080/#/c/23237/15/be/src/rpc/authentication-test.cc@516
PS15, Line 516: ASSERT_FALSE(status.ok());
This is a very good list of test cases. I think it would be good to add a url such as "http:/localhost:25000/SAML2/SSO"
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@263
PS13, Line 263: vector<string> split = Split(url, delimiter::Limit("/", 3));
> Added.
Done
Very comprehensive test suite!
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@277
PS13, Line 277: bool ParseParams(std::map<string, string*>& params_to_check, const string& original,
> Added.
Done
Nice list of test cases!
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@280
PS13, Line 280: vector<string> key_value = Split(pair, delimiter::Limit("=", 1));
> It means the parameter doesn't have the standard key=value format. The code
Done. Thanks for the explanation.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/rpc/authentication-util.cc@326
PS13, Line 326:
> Thanks Csaba. I can only add that without load balancer multiple coordinato
Oh, yes, those two statements are rather ambiguous. My intention was to test the server rejecting the SAML assertion, the client requesting a new one, and the client sending it back to the server.
In hindsight, that is a test case for clients to implement and should not be tested as part of this patch.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc
File be/src/util/backend-gflag-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@174
PS13, Line 174: for client conn
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@180
PS13, Line 180: debug web
> ack, maybe 'debug web UI'
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@190
PS13, Line 190:
> ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/backend-gflag-util.cc@194
PS13, Line 194:
> ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h
File be/src/util/webserver.h:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h@202
PS13, Line 202:
: // Returns a '401 - Unauthorized' / 'AuthenticationRequired' to the client.
: void returnUnauthorized(
: struct sq_connection* connection);
:
: // Helper method to handle SAML authentication failure with metrics and return code
: sq_callback_result_t returnSamlAuthFailure(struct sq_connection* connection);
:
: // Returns a response based on a TWrappedHttpResponse that can come from Frontend code.
: void returnWrappedResponse(
: struct sq_connection* connection, const impala::TWrappedHttpResponse& response);
:
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.h@329
PS13, Line 329: a before s
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@373
PS13, Line 373: || use_saml_
> @Csaba, thanks for details!
I was thinking the test would be for authenticating to the debug web ui using multiple auth methods.
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@851
PS13, Line 851: bool use_saml = use_saml_ && !sq_get_header(connection, "X-Impala-EETest");
> Actually the comment above is wrong here. I confused 'FLAGS_saml2_ee_test_m
Ah, that is helpful. It still appears to me that any client specifying the `X-Impala-EETest` http header will be automatically authenticated if SAML auth is the only auth method available (since that case results in auth_mode_ being set to AuthMode::NONE).
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@87
PS13, Line 87: // 1. Validate that InResponseTo matches a request ID we actually sent
> This method is not even needed.
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@93
PS13, Line 93:
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@108
PS13, Line 108: WithLocationAction locationAction = (WithLocationAction) redirect.get();
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@137
PS13, Line 137: return nameId;
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/15/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java@61
PS15, Line 61: // ReplayCache is now configured via ImpalaSAMLMessageStoreFactory in getSamlConfig().
Nice!
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@46
PS13, Line 46: ImpalaSamlClientHS2.class.getSimpleName(),
: HiveSamlRelayStateStoreHS2.get(),
> Good point, fixed
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@53
PS13, Line 53: throws InternalException {
> Fixed
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java
File fe/src/main/java/org/apache/impala/service/JniFrontend.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java@825
PS13, Line 825: Preconditions.checkNotNull(client, "SAML client not configured. "
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/service/JniFrontend.java@844
PS13, Line 844:
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py@145
PS13, Line 145: assertation_id=str(uuid.uuid4()),
> Done. The first three are easy.
Nice tests! Thanks for adding.
For Note 2, it's still good to verify replay attacks are not possible to make sure code/configurations are not accidentally changed in a way to re-enables replay attacks.
http://gerrit.cloudera.org:8080/#/c/23237/13/tests/custom_cluster/test_saml2_sso.py@324
PS13, Line 324: self._test_common_protocol_checks()
> Good point.
Done
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 15
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Feb 2026 20:20:07 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 16:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/16/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/16/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS16, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/16/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/16/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS16, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/16/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/16/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS16, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/16/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS16, Line 143: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 16
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 05 Feb 2026 16:14:58 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#11). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
31 files changed, 1,598 insertions(+), 789 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/11
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 11
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 12:
(4 comments)
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/rpc/authentication.cc@979
PS12, Line 979: auto response_ptr = GetSaml2RedirectInternal(*request);
optional:
I would change 2 things about this:
- I prefer writing the type instead of using auto in this case, as the type is not that long and it improves readability
- connection_context->response.get() could be used directly to make this more compact:
DCHECK(connection_context->response.get() == nullptr);
connection_context->response = GetSaml2RedirectInternal(*request);
return connection_context->response.get();
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/11/be/src/util/webserver.cc@1018
PS11, Line 1018: pStatusC
> ack
another typo :)
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/util/webserver.cc@1035
PS12, Line 1035: } else if (response->status_code
: == HttpStatusCodeToInt(HttpStatusCode::AuthenticationRequired)) {
Is it possible to get other status codes? I don't see "authenticated" being checked after this point - does passing through means that it is considered authenticated?
http://gerrit.cloudera.org:8080/#/c/23237/12/be/src/util/webserver.cc@1219
PS12, Line 1219: content_len
This is not new code, but it seems better to call reserve(content_len) on out_body.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 12
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 20 Jan 2026 14:15:36 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#13). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
31 files changed, 1,610 insertions(+), 788 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/13
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#27). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,690 insertions(+), 803 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/27
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 27
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 22:
(12 comments)
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc
File be/src/rpc/authentication-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc@326
PS22, Line 326: Status status =
Unused variable "status".
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication-util.cc@336
PS22, Line 336:
Nit: remove extra space.
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication.cc
File be/src/rpc/authentication.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/rpc/authentication.cc@992
PS22, Line 992: ValidateSaml2AuthnResponseInternal(*request);
The "ValidateSaml2AuthnResponseInternal" function can return nullptr. That return needs to be handled here like it was previously:
if (UNLIKELY(response_ptr == nullptr)) {
return nullptr;
}
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@952
PS18, Line 952: authenticated = true;
> It turns out it's not really used for production, I was wrong. Added the fl
Done
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@117
PS22, Line 117: "--webserver_require_spnego.");
Need to also note htpasswd cannot be used with SAML.
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@355
PS22, Line 355: // excluding catalogd, statestored and impalad executors
Executors, catalogd, and statestored all have debug webUIs, why not include those too since the Jira is not limited to just coordinator UI?
http://gerrit.cloudera.org:8080/#/c/23237/22/be/src/util/webserver.cc@940
PS22, Line 940: static constexpr const char kJsonMetricsPath[] = "/jsonmetrics";
: static constexpr const char kBackendsPath[] = "/backends";
: static constexpr const char kVarzPath[] = "/varz";
These three constants need to be shared with the constants passed to the various RegisterUrlCallback() functions to ensure the same paths are used (e.g. in https://github.com/apache/impala/blob/0192436705de1ce8210c0632f08e4e55fb9abd9e/be/src/util/metrics.cc#L144).
Also, match constant names to Impala coding standards (https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65868536#:~:text=classic%20%23include%20guards-,Variable%20Naming,-We%20use%20UPPER_CASE)
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS22, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> line too long (139 > 90)
Please include the exact commit hash this file was base upon.
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS22, Line 38: StateStore
Nit: please consider renaming to HiveSamlRelayStateCacheBase only to avoid confusion with the Impala statestored.
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS22, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
Please include the exact commit hash this file was base upon.
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS22, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
> line too long (144 > 90)
Please include the exact commit hash this file was base upon.
http://gerrit.cloudera.org:8080/#/c/23237/22/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS22, Line 143: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
> line too long (129 > 90)
Please include the exact commit hash this file was base upon.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 22
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Mon, 01 Jun 2026 18:15:46 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 30:
(5 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java:
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java@32
PS30, Line 32: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSamlAuthTokenGenerator.java
line too long (164 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS30, Line 20: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (169 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS30, Line 24: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateStore.java
line too long (170 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS30, Line 32: // based on https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (162 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/30/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS30, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (158 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 30
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 15 Sep 2026 11:15:06 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 30:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/24030/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 30
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 15 Sep 2026 11:36:34 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 30: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 30
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 15 Sep 2026 15:50:05 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 29: Code-Review+2
thanks for working on this, lgtm!
there is another review that touches saml tests and is likely to conflict: https://gerrit.cloudera.org/#/c/24796/ - it should be merged soon - please wait for that changes to be merged, and once conflicts are resolved I can merge this too
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 29
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 09 Sep 2026 14:38:32 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 1:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/1/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java:
http://gerrit.cloudera.org:8080/#/c/23237/1/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java@66
PS1, Line 66: //TODO handle the replayCache as described in http://www.pac4j.org/docs/clients/saml.html
line too long (93 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py
File tests/custom_cluster/test_saml2_sso_webserver.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py@263
PS1, Line 263: a
flake8: E501 line too long (96 > 90 characters)
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py@266
PS1, Line 266: a
flake8: E501 line too long (113 > 90 characters)
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py@269
PS1, Line 269: :
flake8: E501 line too long (98 > 90 characters)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 1
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Sun, 03 Aug 2025 22:53:43 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 13:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21452/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 21 Jan 2026 17:10:09 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#15). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
34 files changed, 2,310 insertions(+), 781 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/15
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 15
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 15:
@Jason, thanks for review! Left the answers.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 15
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Feb 2026 17:26:40 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 16:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/13/be/src/util/webserver.cc@851
PS13, Line 851: bool use_saml = use_saml_ && !sq_get_header(connection, "X-Impala-EETest");
> Hmm, we can do this only for FLAGS_saml2_ee_test_mode, but in that case we
The open_debug_webpage function (https://gerrit.cloudera.org/c/23237/16/tests/common/impala_service.py#80) uses basic auth. What about also enabling basic auth along with SAML and only use it for the bootstrap checks?
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 16
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Thu, 05 Feb 2026 19:07:11 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 19:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/19/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/19/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS19, Line 20: // copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (139 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/19/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/19/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS19, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/19/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/19/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS19, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/19/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS19, Line 143: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 19
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Sun, 08 Mar 2026 22:15:00 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 2:
(4 comments)
Updates:
-bugfixing
-unified java code for HS2 and WS
-unified tests for HS2 and WS
-removed ClientIdentifier from RelayState for WS workflow
-there's a rare flaky crash on repeating WS tests, investigating..
http://gerrit.cloudera.org:8080/#/c/23237/1/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/1/be/src/util/webserver.cc@930
PS1, Line 930: AddCookie(request_info->re
> IMO this block should be done at the very end, after LDAP and Kerberos auth
Agree, done.
http://gerrit.cloudera.org:8080/#/c/23237/1/be/src/util/webserver.cc@1163
PS1, Line 1163: }
> maybe reuse this somehow?
Done. Extracted this version to common code though, since its shorter and the output is identical.
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py
File tests/common/impala_service.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py@82
PS1, Line 82: X-Impa
> An even more complex alternative would be to actually use SAML2 by detecting in the test that relevant flags are set - it would be enough to do one request that gets redirected and after that we could just reuse the cookie. The benefit of this that it could increase coverage of SAML code.
You mean to do saml2 on the bootstrap stage, by somehow sending the dummy messages from test here? I don't see how to do this nicely, but also wouldn't this invalidate the test itself, given that the cookies were already granted?
I was also thinking about detecting the startup flags, but only to determine weather to include the header or not, so it's not sent unnecessarily all the time. But I don't see a nice way how to do this neither, since these checks are called from different places with large stack of routines in between.
Changed the header name for now though.
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py
File tests/custom_cluster/test_saml2_sso_webserver.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/custom_cluster/test_saml2_sso_webserver.py@18
PS1, Line 18:
Absolutely! merged everything into the original file with the base class.
> It would also make it easier to test both having SAML2 in hs2-http and webui at the same time which is probably the most realistic scenario.
Please clarify what you mean by this. Currently hs2-http and webui are two different authentications with different ACS ports, metadata files and not compatible cookies. I.e. each test is starting its own custom cluster with its own set of flags.
In terms of uniting the two auths, what seems feasible to me right now is:
1. issue a separate port for SAML2 ARC, other then 25000 and 28000, for both servers. This way it's enough to have a single idp and single impalad config.
2. keep the cookies separate.
3. with this approach we still need separate clients in java for different logic, but a bit more code can be reused
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 2
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Thu, 14 Aug 2025 15:40:05 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#2). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and improved end-to-end tests for SAML2 SSO in the webserver
Notes:
- Theoretically SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_service.py
M tests/custom_cluster/test_saml2_sso.py
22 files changed, 1,328 insertions(+), 529 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/2
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 2
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 2:
(6 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/2/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/2/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS2, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/2/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/2/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@31
PS2, Line 31: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/2/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@102
PS2, Line 102: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/2/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/2/tests/custom_cluster/test_saml2_sso.py@76
PS2, Line 76: a
flake8: E501 line too long (96 > 90 characters)
http://gerrit.cloudera.org:8080/#/c/23237/2/tests/custom_cluster/test_saml2_sso.py@79
PS2, Line 79: a
flake8: E501 line too long (113 > 90 characters)
http://gerrit.cloudera.org:8080/#/c/23237/2/tests/custom_cluster/test_saml2_sso.py@82
PS2, Line 82: :
flake8: E501 line too long (98 > 90 characters)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 2
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Thu, 14 Aug 2025 15:41:10 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#3). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and improved end-to-end tests for SAML2 SSO in the webserver
Notes:
- Theoretically SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_service.py
M tests/custom_cluster/test_saml2_sso.py
22 files changed, 1,328 insertions(+), 529 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/3
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 3
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 11:
(6 comments)
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/transport/THttpServer.h
File be/src/transport/THttpServer.h:
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/transport/THttpServer.h@231
PS9, Line 231: the bearer token is expected.
> nit: "where bearing token is expected"?
ack
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/util/backend-gflag-util.cc
File be/src/util/backend-gflag-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/util/backend-gflag-util.cc@193
PS9, Line 193: ws_saml2_sp_callback_url
> optional: webserver_saml2_sp_callback_url would be clearer
yeah but a bit too long imho
http://gerrit.cloudera.org:8080/#/c/23237/9/common/thrift/metrics.json
File common/thrift/metrics.json:
http://gerrit.cloudera.org:8080/#/c/23237/9/common/thrift/metrics.json@3944
PS9, Line 3944: mpted to authent
> This sounds unfinished - a similar description could be used as for hs2 sam
ack
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS9, Line 38: public abstract class HiveSamlRelayStateStoreBase<T> implements ValueGenerator {
> I don't see the original class removed - is that still needed?
Yeah, my bad.
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java:
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java@80
PS9, Line 80: @Override
: public void validateAuthnResponse(WrappedWebContext webContext)
: throws InternalException {
: validateAuthnResponseCommon(webContext, HiveSamlRelayStateStoreWS.get(),
: new AuthnResponseHandler<HiveSamlRelayStateInfoWS>() {
: @Override
: public void handleSuccess(WrappedWebContext webContext, String nameId,
: String relayState, HiveSamlRelayStateInfoWS relayStateInfo) {
: Preconditions.checkState(nameId != null);
: String uri = relayStateInfo.getUri();
: LOG.debug("Successfully validated saml response. Forwarding to " + uri);
: webContext.setResponseStatusCode(302);
: webContext.setResponseHeader("Location", uri);
: // returning authenticated user name in response's body
: webContext.setResponseContent("", nameId);
: }
:
: @Override
: public void handleFailure(WrappedWebContext webContext,
: HiveSamlRelayStateInfoWS relayStateInfo, String errorMsg) {
: webContext.setResponseStatusCode(401);
: webContext.setResponseContent("", errorMsg);
: }
: });
: }
: }
:
:
:
> This seems nearly the same as HiveSamlHttpServlet.doPost()
I agree, the whole doPost() thing was a bit awkward. Refactored.
http://gerrit.cloudera.org:8080/#/c/23237/9/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/9/tests/custom_cluster/test_saml2_sso.py@383
PS9, Line 383: """
> I find the inheritance with tests quite unusual. Also, I don't see a good r
That seemed like clearer design but perhaps too much as for tests. Refactored.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 11
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Wed, 17 Dec 2025 12:14:30 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#21). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
34 files changed, 2,681 insertions(+), 693 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/21
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 21
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#22). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
35 files changed, 2,678 insertions(+), 801 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/22
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 22
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 19:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@356
PS18, Line 356: FLAGS_is_coordinator && !FLAGS_webserver_saml2_sp_callback_u
> Yeah, makes sense, since only impalad can be coordinator anyway.
Done
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@945
PS18, Line 945: const char* uri = request_info->uri;
: const bool is_monitoring_endpoint =
: strncmp(uri, kJsonMetricsPath,
> Ack
Done
http://gerrit.cloudera.org:8080/#/c/23237/18/be/src/util/webserver.cc@952
PS18, Line 952: check_csrf_protection = false;
> I may be missing something, but the problem is that this flag also skips th
Ah, I wasn't thinking of cases where start-impala-cluster.py would be used beyond dev/testing. I don't know if that script is used outside dev/testing since most production instances of Impala use separate machines for each daemon. Can you please investigate whether or not start-impala-cluster.py is used outside of Impala dev/testing, and if it is, whether or not SAML auth is needed?
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 19
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 10 Mar 2026 21:43:52 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 29:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/23901/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 29
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 02 Sep 2026 17:38:03 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 4:
(3 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/4/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/4/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS4, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/4/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/4/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@31
PS4, Line 31: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/4/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@102
PS4, Line 102: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 4
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Thu, 21 Aug 2025 13:54:40 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 3:
(11 comments)
http://gerrit.cloudera.org:8080/#/c/23237/3//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/23237/3//COMMIT_MSG@10
PS3, Line 10: Impala Web UI
Just realized that there is a major question about the scope of the change: should it work for all Impala services, or only for coordinators?
This was not a question for hs2-http, as it is relevant only for coordinators - but each daemon has a webui.
The following daemons could come up:
1. executor only impalad
2. catalogd
3. statestored
4. admissiond
1 an 2 should not be problematic, as these have an embedded JVM, but 3 (statestored) is cpp only without native JVM, so the current Java implementation of SAML would not work.
I think that for now the patch should simply clarify the scope, but we should think trough other daemons in the future.
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@977
PS2, Line 977: GetRemoteAddress
Mainly a note for myself: GetRemoteAddress() does not work with ipv6 at the moment, the Kudu utility classes only support ipv4. Getting a Kudu that contains https://gerrit.cloudera.org/#/c/22984/11/src/kudu/util/net/sockaddr.h would solve this.
A different question is how to test it - it wouldn't be too hard to start saml tests with listening dual host and trying a connection on both ipv4 and 6 localhost.
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@977
PS2, Line 977: ToString();
: string ip_str = addr_str.substr(0, addr_str.find(':'));
Sockaddr hast function host() for this.
Note that splitting by ":" wouldn't work with an ipv6 address which can contain colons.
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@992
PS2, Line 992: string host = sq_get_header(connection, "Host");
: DCHECK(!host.empty());
Can we always assume a non-empty host? Can't a client sent a http request without Host set?
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1001
PS2, Line 1001: } else {
Can you add a comment that the successful response is a redirect?
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1033
PS2, Line 1033: for (const auto& h : headers) {
: auto pos = h.find(": ");
: if (pos != std::string::npos) {
: response->headers[h.substr(0, pos)] = h.substr(pos + 2);
: }
: }
Can you explain and a comment about what is done here exactly?
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1093
PS2, Line 1093: post_body_read==FALS
!post_body_read ?
http://gerrit.cloudera.org:8080/#/c/23237/2/be/src/util/webserver.cc@1199
PS2, Line 1199: max_length
This variable looks unused, as FLAGS_webserver_max_post_length_bytes is used as max length.
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py
File tests/common/impala_service.py:
http://gerrit.cloudera.org:8080/#/c/23237/1/tests/common/impala_service.py@82
PS1, Line 82: X-Impa
> > An even more complex alternative would be to actually use SAML2 by detect
>But I don't see a nice way how to do this neither
BaseImpalaService has access to the flags, see my ipv6 change and the plumbing of external_interface:
https://gerrit.cloudera.org/#/c/22527/36/tests/common/impala_service.py
https://gerrit.cloudera.org/#/c/22527/36/tests/common/impala_cluster.py
This reminded me about a bigger issue, which affects the whole patch: ideally saml would work for all Impala deamons, not just the commit message.
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py@112
PS3, Line 112: <samlp:Response
optional: my original reason for putting this and ATTRIBUTE_STATEMENT in the bottom is to reduce noise in the tests, as these templates are long and not very interesting - I would prefer to keep it that way, but I am not sticking to this idea
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py@177
PS3, Line 177: for vector in\
: [ImpalaTestVector([value]) for value in create_client_protocol_dimension()]:
: protocol = vector.get_value("protocol")
: if protocol != "hs2-http":
: # SAML2 should not affect non http protocols.
: args = ["--protocol=%s" % protocol, "-q", "select 1 + 2"]
: run_impala_shell_cmd(vector, args, expect_success=True)
: continue
:
: # hs2-http connections without further arguments should be rejected.
: args = ["--protocol=hs2-http", "-q", "select 1 + 2"]
: run_impala_shell_cmd(vector, args, expect_success=False)
ImpalaTestSuite.check_connections(cls, expected_count=3) could be used for this - from the 3 protocols 2 are expected to succeed - check_connections() was added when I implemented ipv6 support, so it was not available when saml tests were implemented
Checking other protocols this way would allow removing create_client_protocol_dimension() and the 'vector' argument from testclasses
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 3
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Mon, 18 Aug 2025 15:45:17 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 2:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/20155/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 2
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Thu, 14 Aug 2025 15:48:05 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 3:
(6 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/3/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/3/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS3, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/3/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/3/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@31
PS3, Line 31: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/3/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@102
PS3, Line 102: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py@76
PS3, Line 76: a
flake8: E501 line too long (96 > 90 characters)
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py@79
PS3, Line 79: a
flake8: E501 line too long (113 > 90 characters)
http://gerrit.cloudera.org:8080/#/c/23237/3/tests/custom_cluster/test_saml2_sso.py@82
PS3, Line 82: :
flake8: E501 line too long (98 > 90 characters)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 3
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Comment-Date: Mon, 18 Aug 2025 13:17:10 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Riza Suminto (Code Review)" <ge...@cloudera.org>.
Riza Suminto has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 4:
In conjunction with https://gerrit.cloudera.org/c/23319/, please also try run the test with Python3.
IMPALA_USE_PYTHON3_TESTS=true impala-py.test --exploration=exhaustive custom_cluster/test_saml2_sso.py
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 4
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Fri, 22 Aug 2025 14:29:38 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#9). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
27 files changed, 1,428 insertions(+), 518 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/9
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 9
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 9:
(3 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS9, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS9, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@108
PS9, Line 108: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 9
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Dec 2025 16:31:34 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 7:
(3 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/7/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/7/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS7, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (157 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/7/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/7/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS7, Line 32: // modified version of https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (144 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/7/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@108
PS7, Line 108: // https://github.com/vihangk1/hive/blob/master_saml/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (129 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 7
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Mon, 15 Dec 2025 12:43:33 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Csaba Ringhofer (Code Review)" <ge...@cloudera.org>.
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
Patch Set 9:
(6 comments)
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/transport/THttpServer.h
File be/src/transport/THttpServer.h:
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/transport/THttpServer.h@231
PS9, Line 231: he/she expects to receive the bearer token.
nit: "where bearing token is expected"?
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/util/backend-gflag-util.cc
File be/src/util/backend-gflag-util.cc:
http://gerrit.cloudera.org:8080/#/c/23237/9/be/src/util/backend-gflag-util.cc@193
PS9, Line 193: ws_saml2_sp_callback_url
optional: webserver_saml2_sp_callback_url would be clearer
http://gerrit.cloudera.org:8080/#/c/23237/9/common/thrift/metrics.json
File common/thrift/metrics.json:
http://gerrit.cloudera.org:8080/#/c/23237/9/common/thrift/metrics.json@3944
PS9, Line 3944: an invalid SAML2
This sounds unfinished - a similar description could be used as for hs2 saml failures.
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS9, Line 38: public abstract class HiveSamlRelayStateStoreBase<T> implements ValueGenerator {
I don't see the original class removed - is that still needed?
https://github.com/apache/impala/blob/master/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java:
http://gerrit.cloudera.org:8080/#/c/23237/9/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java@80
PS9, Line 80: @Override
: public void validateAuthnResponse(WrappedWebContext webContext)
: throws InternalException {
: String nameId;
: String relayState;
: String uri;
: try {
: relayState = HiveSamlRelayStateStoreWS.get().getRelayStateInfo(webContext);
: uri = HiveSamlRelayStateStoreWS.get().getRelayStateInfo(relayState).getUri();
: } catch (HttpSamlAuthenticationException e) {
: LOG.error("Invalid relay state", e);
: webContext.setResponseStatusCode(HttpStatus.SC_UNAUTHORIZED);
: return;
: }
: try {
: LOG.debug("RelayState uri is " + uri);
: nameId = validateAuthnResponseInner(webContext);
: } catch (HttpSamlAuthenticationException e) {
: if (e instanceof HttpSamlNoGroupsMatchedException) {
: LOG.error("Could not authenticate user since the groups didn't match", e);
: } else {
: LOG.error("SAML response could not be validated", e);
: }
: webContext.setResponseStatusCode(401);
: webContext.setResponseContent("",
: "SAML assertion could not be validated. Check server logs for more details.");
: return;
: }
: Preconditions.checkState(nameId != null);
This seems nearly the same as HiveSamlHttpServlet.doPost()
HiveSamlHttpServlet was created to keep Hive and Impala code as similar as possible, but this seems less important now as both projects have moved.
My idea would be to move most of validateAuthnResponse to ImpalaSamlClientBase and delete HiveSamlHttpServlet. There are tiny differences like uri vs port, but a common relay object could be used instead.
http://gerrit.cloudera.org:8080/#/c/23237/9/tests/custom_cluster/test_saml2_sso.py
File tests/custom_cluster/test_saml2_sso.py:
http://gerrit.cloudera.org:8080/#/c/23237/9/tests/custom_cluster/test_saml2_sso.py@383
PS9, Line 383: Inherits from both TestHS2Saml and TestWebserverSaml to reuse their methods.
I find the inheritance with tests quite unusual. Also, I don't see a good reason, though maybe I miss something - can't all _* utility functions go to base and tests only to lead classes?
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 9
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Tue, 16 Dec 2025 16:10:18 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Impala Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#10). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Impala Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Impala Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
R fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
C fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
C fe/src/main/java/org/apache/impala/authentication/saml/RelayStateInfo.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
30 files changed, 1,484 insertions(+), 742 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/10
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 10
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 18:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21859/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 18
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 04 Mar 2026 14:05:59 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#16). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
34 files changed, 2,320 insertions(+), 781 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/16
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 16
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Jason Fehr (Code Review)" <ge...@cloudera.org>.
Jason Fehr has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 13:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java:
http://gerrit.cloudera.org:8080/#/c/23237/13/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreBase.java@38
PS13, Line 38: T
Should this be <T extends HiveSamlRelayStateInfo>?
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 13
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 30 Jan 2026 01:43:09 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 14:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/21535/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 14
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 30 Jan 2026 12:42:41 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 21:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/22328/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 21
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Tue, 05 May 2026 12:08:13 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has uploaded a new patch set (#26). ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
This change introduces SAML2 Browser Profile authentication for the
Impala Web UI, largely reusing and adapting the approach from
IMPALA-10437 (HS2-HTTP server). The implementation is simplified for the
webserver context, where the browser acts as the SAML client. The flow
consists of:
1. Redirecting the user to the SSO provider for authentication
2. Validating the SAML authNResponse and redirecting back to the
original resource with a Set-Cookie header
The initial resource URI is preserved as RelayState and restored after
successful authentication.
Key changes:
- Refactored C++ webserver and authentication utilities to support SAML2
flow
- Added new Java classes for SAML relay state and client logic
- Added and refactored end-to-end tests for SAML2 SSO in the webserver
Notes:
- Supposedly SAML authentication may be used alongside other methods,
but the logic is not fully clear yet; also this would require additional
testing
Testing:
- tests/custom_cluster/test_saml2_sso.py::TestWebserverSaml to simulate
SAML workflow with Python's urllib2
- tests/custom_cluster/test_webserver_auth_combined.py for LDAP+SAML2
and SPNEGO+SAML2 intelligent fallthrough (skips auth attempt when no
Authorization header present)
- CTEST for ParseSamlSpUrl, ParseParams
Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
---
M be/src/kudu/util/web_callback_registry.h
M be/src/rpc/authentication-test.cc
M be/src/rpc/authentication-util.cc
M be/src/rpc/authentication-util.h
M be/src/rpc/authentication.cc
M be/src/service/impala-http-handler.cc
M be/src/transport/THttpServer.cpp
M be/src/transport/THttpServer.h
M be/src/util/backend-gflag-util.cc
M be/src/util/default-path-handlers.cc
M be/src/util/metrics.cc
M be/src/util/webserver.cc
M be/src/util/webserver.h
M common/thrift/BackendGflags.thrift
M common/thrift/metrics.json
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlAuthTokenGenerator.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlHttpServlet.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateCacheBase.java
M fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfo.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoWS.java
D fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreWS.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStore.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSAMLMessageStoreFactory.java
D fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClient.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientBase.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
A fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientWS.java
M fe/src/main/java/org/apache/impala/service/BackendConfig.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M tests/common/impala_cluster.py
M tests/common/impala_service.py
M tests/common/impala_test_suite.py
M tests/custom_cluster/test_saml2_sso.py
A tests/custom_cluster/test_webserver_auth_combined.py
38 files changed, 2,689 insertions(+), 803 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/23237/26
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 26
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 24:
(4 comments)
gerrit-auto-critic failed. You can reproduce it locally using command:
python3 bin/jenkins/critique-gerrit-review.py --dryrun
To run it, you might need a virtual env with Python3's venv installed.
http://gerrit.cloudera.org:8080/#/c/23237/24/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/24/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS24, Line 20: // copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (168 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/24/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/24/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS24, Line 24: // slightly modified copy of https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
line too long (186 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/24/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/24/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@32
PS24, Line 32: // modified version of https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/auth/saml/HiveSaml2Client.java
line too long (173 > 90)
http://gerrit.cloudera.org:8080/#/c/23237/24/fe/src/main/java/org/apache/impala/authentication/saml/ImpalaSamlClientHS2.java@143
PS24, Line 143: // https://github.com/vihangk1/hive/blob/d0209a6f026106622523bd4ec7eeeae33782e7a3/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java
line too long (158 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 24
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Fri, 05 Jun 2026 16:55:10 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
Posted by "Mihaly Szjatinya (Code Review)" <ge...@cloudera.org>.
Mihaly Szjatinya has posted comments on this change. ( http://gerrit.cloudera.org:8080/23237 )
Change subject: IMPALA-14285: Add SAML2 authentication support for Coordinator Web UI
......................................................................
Patch Set 28:
(5 comments)
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc
File be/src/util/webserver.cc:
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc@564
PS27, Line 564:
> Similarly to this we should normally reject starting up is saml is enable w
Yeah, this remained overlooked.
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc@1037
PS27, Line 1037: se =
> Do we need the host in this? My assumption is that it is either the Impala
You're right, it works without it. I don't remember why I added this back then.
http://gerrit.cloudera.org:8080/#/c/23237/27/be/src/util/webserver.cc@1067
PS27, Line 1067:
> Why is the cooke generated with extra arg compared to other cases? Can you
Done
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateInfoHS2.java@20
PS27, Line 20: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateInfo.java
> nit: this is no longer a copy
Ack, unified everywhere and fixed some links.
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java
File fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java:
http://gerrit.cloudera.org:8080/#/c/23237/27/fe/src/main/java/org/apache/impala/authentication/saml/HiveSamlRelayStateStoreHS2.java@24
PS27, Line 24: // based on https://github.com/vihangk1/hive/blob/45863cc1fc94c2f2a848d0f3fc160a4dc0214747/service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateStore.java
> "based on" would be better now
Ack
--
To view, visit http://gerrit.cloudera.org:8080/23237
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I12540300529f9c240abf7196141ecb0ae6e37995
Gerrit-Change-Number: 23237
Gerrit-PatchSet: 28
Gerrit-Owner: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Abhishek Rawat <ar...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Jason Fehr <jf...@cloudera.com>
Gerrit-Reviewer: Mihaly Szjatinya <ms...@pm.me>
Gerrit-Reviewer: Nandor Kollar <ko...@gmail.com>
Gerrit-Reviewer: Riza Suminto <ri...@gmail.com>
Gerrit-Comment-Date: Wed, 02 Sep 2026 14:28:27 +0000
Gerrit-HasComments: Yes