You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by "njnu-seafish (via GitHub)" <gi...@apache.org> on 2026/06/25 12:34:44 UTC
[PR] [Improvement-18383][API]Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
njnu-seafish opened a new pull request, #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384
<!--Thanks very much for contributing to Apache DolphinScheduler, we are happy that you want to help us improve DolphinScheduler! -->
## Was this PR generated or assisted by AI?
YES. Use AI to find and modify the code, then test and verify it locally.
## Purpose of the pull request
close #18383
## Brief change log
Disable create user, reset password, and username edit in non-PASSWORD auth modes
## Verify this pull request
<!--*(Please pick either of the following options)*-->
This pull request is code cleanup without any test coverage.
*(or)*
This pull request is already covered by existing tests, such as *(please describe tests)*.
(or)
This change added tests and can be verified as follows:
<!--*(example:)*
- *Added dolphinscheduler-dao tests for end-to-end.*
- *Added CronUtilsTest to verify the change.*
- *Manually verified the change by testing locally.* -->
(or)
## Pull Request Notice
[Pull Request Notice](https://github.com/apache/dolphinscheduler/blob/dev/docs/docs/en/contribute/join/pull-request.md)
If your pull request contains incompatible change, you should also add it to `docs/docs/en/guide/upgrade/incompatible.md`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API]Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#issuecomment-4805679322
> Do we also need to add a check for the PASSWORD authentication type in the backend controllers? If the authentication mode is non-PASSWORD, the backend should not allow operations such as user creation and password modification.
Yes. Both front-end and back-end need to be modified, please submit it in this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "njnu-seafish (via GitHub)" <gi...@apache.org>.
njnu-seafish commented on PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#issuecomment-4831973991
> The frontend checks added in this PR rely on `userStore.getSecurityConfigType`, but the OAuth2/OIDC redirect path only stores the session and userInfo. Because the user store is persisted, a browser that previously logged in with PASSWORD can keep a stale `securityConfigType === 'PASSWORD'`, so OIDC/OAuth2 users may still see enabled create/reset/password UI. The redirect login path should also populate the current security config type before entering the app.
The level of thoroughness in this review is outstanding. Really impressive work! Your review is very thorough.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on code in PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#discussion_r3488976725
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:
##########
@@ -358,6 +371,10 @@ public User updateUser(User loginUser,
if (StringUtils.isNotEmpty(userName)) {
+ if (isNotPasswordAuthenticationMode()) {
+ throw new ServiceException(Status.OPERATION_NOT_ALLOWED_IN_NON_PASSWORD_MODE);
Review Comment:
This rejects unchanged usernames too. Normal non-credential edits such as email/phone/tenant/state now fail in LDAP/OIDC/SSO mode.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "njnu-seafish (via GitHub)" <gi...@apache.org>.
njnu-seafish commented on code in PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#discussion_r3526166079
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:
##########
@@ -101,6 +103,20 @@ public class UsersServiceImpl extends BaseServiceImpl implements UsersService {
@Autowired
private SessionService sessionService;
+ @Value("${security.authentication.type:PASSWORD}")
+ private String securityAuthenticationType = AuthenticationType.PASSWORD.name();
+
+ @Value("${security.authentication.oauth2.enable:false}")
+ private boolean oauth2Enabled;
+
+ private boolean isPasswordManagementDisabled() {
+ if (oauth2Enabled) {
+ return true;
+ }
+ return StringUtils.isNotBlank(securityAuthenticationType)
+ && !AuthenticationType.PASSWORD.name().equals(securityAuthenticationType);
+ }
Review Comment:
> This is an incompatible modification and needs to be added to the document. `docs/docs/en/guide/upgrade/incompatible.md` `docs/docs/zh/guide/upgrade/incompatible.md`
>
> When `security.authentication.type = password` and `oauth2.enable=true` at the same time, it will lead to confusion for users, so we should add a unified type for users to choose.
This is actually a separate issue. I plan to create a new issue to handle it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "njnu-seafish (via GitHub)" <gi...@apache.org>.
njnu-seafish commented on code in PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#discussion_r3491363043
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:
##########
@@ -358,6 +371,10 @@ public User updateUser(User loginUser,
if (StringUtils.isNotEmpty(userName)) {
+ if (isNotPasswordAuthenticationMode()) {
+ throw new ServiceException(Status.OPERATION_NOT_ALLOWED_IN_NON_PASSWORD_MODE);
Review Comment:
> This rejects unchanged usernames too. Normal non-credential edits such as email/phone/tenant/state now fail in LDAP/OIDC/SSO mode.
Very thorough.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#issuecomment-4889783011
I'm not sure whether we should make this change. At present, we support the coexistence of multiple authentication types. Should we change it to only a single authentication type? @ruanwenjun @zhongjiajie
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API]Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "njnu-seafish (via GitHub)" <gi...@apache.org>.
njnu-seafish commented on PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#issuecomment-4799294036
Do we also need to add a check for the PASSWORD authentication type in the backend controllers? If the authentication mode is non-PASSWORD, the backend should not allow operations such as user creation and password modification.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS closed pull request #18384: [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes
URL: https://github.com/apache/dolphinscheduler/pull/18384
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on code in PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#discussion_r3526821955
##########
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:
##########
@@ -101,6 +103,20 @@ public class UsersServiceImpl extends BaseServiceImpl implements UsersService {
@Autowired
private SessionService sessionService;
+ @Value("${security.authentication.type:PASSWORD}")
+ private String securityAuthenticationType = AuthenticationType.PASSWORD.name();
+
+ @Value("${security.authentication.oauth2.enable:false}")
+ private boolean oauth2Enabled;
+
+ private boolean isPasswordManagementDisabled() {
+ if (oauth2Enabled) {
+ return true;
+ }
+ return StringUtils.isNotBlank(securityAuthenticationType)
+ && !AuthenticationType.PASSWORD.name().equals(securityAuthenticationType);
+ }
Review Comment:
This is the same kind of thing. For users, it is an incompatible changes. Please submit it in the current PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Improvement-18383][API] Disable create user, reset password, and username edit in non-PASSWORD auth modes [dolphinscheduler]
Posted by "njnu-seafish (via GitHub)" <gi...@apache.org>.
njnu-seafish commented on PR #18384:
URL: https://github.com/apache/dolphinscheduler/pull/18384#issuecomment-4842851837
> The PR marks OAuth2 redirect logins as securityConfigType=OAUTH2 on the frontend, but the backend guard in UsersServiceImpl checks only security.authentication.type. OAuth2 is enabled separately and can be used together with PASSWORD, so in that common setup the UI disables create/reset/edit-password, but /users/create, /users/update, and /users/register still pass the backend guard because security.authentication.type remains PASSWORD.
ok, add logic to reject password-managed user operations when OAuth2 is enabled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org