You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@texera.apache.org by "Neilk1021 (via GitHub)" <gi...@apache.org> on 2026/07/21 20:20:52 UTC
[I] Decouple authentication from the user record and support multiple login providers [texera]
Neilk1021 opened a new issue, #6718:
URL: https://github.com/apache/texera/issues/6718
### Feature Summary
### Current Problem
Authentication data is stored directly on the `"user"` table: `password`, `google_id`,
and `google_avatar`, gated by a `ck_nulltest` CHECK ("password OR google_id must be set").
This couples *who a user is* (identity) to *how they authenticate* (credentials), which has
several consequences:
- **A user can only ever have one external identity.** `google_id` is a single column, so a
user cannot link more than one provider, and adding a new provider (Facebook, GitHub, SSO…)
means adding yet another column + widening the `ck_nulltest` CHECK each time.
- **Provider-specific fields leak into the identity model and the JWT.** `googleId` /
`googleAvatar` are baked into `jwtClaims`, the `SessionUser`, the frontend `User` type, and
several resources — none of which should care which provider a user logged in with.
- **Login provisioning logic is duplicated per provider.** Each OAuth resource re-implements
its own "find user by provider id → else by email → else create → attach credential" flow.
### High level feature
Separate identity from credentials so that:
1. The `"user"` table holds only identity/profile data; a dedicated table holds one row per
`(user, provider)` credential, allowing a user to have multiple linked providers.
2. Adding a new auth provider requires **no schema change** — only a new verifier that maps the
provider's token to a common profile shape.
3. The JWT and the user model are **provider-agnostic** (a single `avatar`, no `googleId`).
4. **Facebook login** is supported as the first proof that the new model is pluggable.
### Related Discussion(s):
Proposal #6716 and #6717
### Proposed Solution or Design
### Scope / acceptance criteria
- [ ] New credential table keyed by `(uid, provider_type)`, with a constraint enforcing the
correct credential shape per provider (password for local, external id for OAuth).
- [ ] A migration moves existing `password` / `google_id` / `google_avatar` data into the new
model without data loss, and drops the columns + `ck_nulltest` from `"user"`.
- [ ] Local, Google, and Facebook login all provision users through one shared code path.
- [ ] JWT carries a provider-neutral `avatar` claim; `googleId`/`googleAvatar` removed
end-to-end (backend + frontend).
- [ ] Facebook login works end-to-end (client-id endpoint, token verification, provisioning).
- [ ] Tests cover the provisioning matrix and the JWT claim change.
### Out of scope
- Additional providers beyond Facebook (GitHub, SAML/SSO) — enabled by this change but not
implemented here.
- Account-linking UI (letting a signed-in user attach a second provider from settings).
### Affected Area
Other
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Decouple authentication from the user record and support multiple login providers [texera]
Posted by "Neilk1021 (via GitHub)" <gi...@apache.org>.
Neilk1021 commented on issue #6718:
URL: https://github.com/apache/texera/issues/6718#issuecomment-5038662000
/take
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Decouple authentication from the user record and support multiple login providers [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan commented on issue #6718:
URL: https://github.com/apache/texera/issues/6718#issuecomment-5124910167
Don't close as completed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Decouple authentication from the user record and support multiple login providers [texera]
Posted by "Neilk1021 (via GitHub)" <gi...@apache.org>.
Neilk1021 closed issue #6718: Decouple authentication from the user record and support multiple login providers
URL: https://github.com/apache/texera/issues/6718
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Decouple authentication from the user record and support multiple login providers [texera]
Posted by "chenlica (via GitHub)" <gi...@apache.org>.
chenlica commented on issue #6718:
URL: https://github.com/apache/texera/issues/6718#issuecomment-5054812773
Agreed. Let's first finish those discussions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Decouple authentication from the user record and support multiple login providers [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on issue #6718:
URL: https://github.com/apache/texera/issues/6718#issuecomment-5040502309
Do we have the plan to support other OAuth methods? In general it is a good idea, but it also adds maintenance cost.
cc @aglinxinyuan @Xiao-zhen-Liu @chenlica for feedback
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Decouple authentication from the user record and support multiple login providers [texera]
Posted by "aglinxinyuan (via GitHub)" <gi...@apache.org>.
aglinxinyuan commented on issue #6718:
URL: https://github.com/apache/texera/issues/6718#issuecomment-5040511222
Yes, we plan to support mutiple SSO.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Decouple authentication from the user record and support multiple login providers [texera]
Posted by "Yicong-Huang (via GitHub)" <gi...@apache.org>.
Yicong-Huang commented on issue #6718:
URL: https://github.com/apache/texera/issues/6718#issuecomment-5040546492
ok. let's try to have discussions on github. I see https://github.com/apache/texera/discussions/6716 and https://github.com/apache/texera/discussions/6717 those two discussions were just created. procedure wise, please finish the discussion before opening issue or PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org