You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "viirya (via GitHub)" <gi...@apache.org> on 2026/09/04 23:36:59 UTC
[PR] [SPARK-59270] Run the JWT auth end-to-end walkthrough in CI [spark-connect-gateway]
viirya opened a new pull request, #21:
URL: https://github.com/apache/spark-connect-gateway/pull/21
### What changes were proposed in this pull request?
The `deploy/examples/e2e-auth-jwt` walkthrough is the only thing that exercises the
Helm chart's auth block end to end. The in-process tests cover `JwtAuthenticator`
itself, but nothing rendered the chart's `auth.type: jwt` ConfigMap or drove a real
PySpark client through the bearer-token transport — so a break in the chart's auth
templating, or in claim propagation, would go unnoticed.
This adds an `e2e-auth-jwt` job to the E2E workflow, running in parallel with
`e2e-smoke` on its own kind cluster. It asserts:
- The chart renders `auth.type: jwt` with the expected issuer and claim mapping
(`tenant_claim`, `groups_claim`).
- A valid HS256 token is accepted, and the `sub` / `tenant` / `groups` claims reach
the audit pipeline: the `session.create` event must report **`user_id=alice`, not
`anonymous`**, plus `tenant=team-a` and `groups=devs,admins`.
- Three rejection paths fail with `UNAUTHENTICATED`: an expired token, a token
signed with the wrong secret, and no token at all.
- **Signature-validation failures all report the same generic `"invalid JWT"`.** A
verifier that distinguishes "expired" from "bad signature" tells an attacker which
half to work on, so this is asserted rather than merely observed.
- The `auth.failure` audit events use only the fixed reasons `invalid_token` and
`missing_token`, and `scg_auth_failures_total` counts both.
Tokens are signed with the 8-line `openssl` helper from the walkthrough — no JWT
library needed. PySpark is pinned to `4.0.0` to match the backend image, as in the
`e2e-smoke` job.
### Why are the changes needed?
Auth is the gateway's security boundary, and the chart's auth templating had no
coverage at all: the unit tests never render the chart, and `e2e-smoke` runs with
`auth: none`. This also pins down the deliberate non-disclosure property of the
error messages, which is easy to regress by "improving" an error string.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Ran the whole walkthrough locally before writing the job: the chart rendered the
expected auth block, the valid token produced `user_id=alice` / `tenant=team-a` /
`groups=devs,admins` in the audit log, all three rejection paths returned
`UNAUTHENTICATED` with the expected messages (the two signature failures with the
identical generic message), and the audit reasons and metrics matched
(`invalid_token` x4, `missing_token` x2). This PR's own run exercises the job on a
hosted runner.
### Was this patch authored or co-authored using generative AI tooling?
Yes, co-authored with Claude Code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-59270] Run the JWT auth end-to-end walkthrough in CI [spark-connect-gateway]
Posted by "viirya (via GitHub)" <gi...@apache.org>.
viirya closed pull request #21: [SPARK-59270] Run the JWT auth end-to-end walkthrough in CI
URL: https://github.com/apache/spark-connect-gateway/pull/21
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-59270] Run the JWT auth end-to-end walkthrough in CI [spark-connect-gateway]
Posted by "viirya (via GitHub)" <gi...@apache.org>.
viirya commented on PR #21:
URL: https://github.com/apache/spark-connect-gateway/pull/21#issuecomment-5578425728
Thanks @dongjoon-hyun !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org