-
Notifications
You must be signed in to change notification settings - Fork 3.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
85965: ccl/jwtauthccl: Implement JWT based auth for CRDB SSO r=kpatron-cockroachlabs a=kpatron-cockroachlabs In order to enable future work to allow customers to log into CRDB instances using SSO, this change implements a new type of auth based on JWTs. Its enablement and configuration is controlled by cluster settings instead of being added as an hba_conf option. In particular, this change introduces three cluster settings: server.jwt_authentication.enable, server.jwt_authentication.jwks, and server.jwt_authentication.issuers. If during login, the custom option `--jwt.auth=true` is sent, the JWT code path is activated and the contents of the "password" field are analyzed as a token, if the enabled cluster setting is set to true. The token signature is validated with the jwks cluster setting. The token's expiration time is validated, the subject field is matched to the username requested, the audience is field is matched against the cluster's ID and the issuer is matched to the value of the issuers cluster setting. Finally, if the token passes all of those checks, CRDB ensures that an enterprise license is active. Release note (enterprise change): A new JWT based auth method has been introduced as an option. This work lays the ground work for users to have SSO based login into their CockroachDB Dedicated clusters. 87292: Fix show_backup diagram. r=nickvigilante a=stbof DOC-5517 The show_backup diagram doesn't unlink `location_opt_list`, so links to it in the SQL grammar. The master branch build fails. Release justification: diagram update. 87932: Diagrams for UDF statements. r=chengxiong-ruan a=stbof 88408: kvserver,clusterversion: {version,feature}-gate lease upgrade logic r=irfansharif a=irfansharif Informs #88301. EnableLeaseUpgrade version gates a change in the lease transfer protocol whereby we only ever transfer expiration-based leases (and have recipients later upgrade them to the more efficient epoch based ones). This was done to limit the effects of ill-advised lease transfers since the incoming leaseholder would need to recognize itself as such within a few seconds. This needs version gating so that in mixed-version clusters, as part of lease transfers, we don't start sending out expiration based leases to nodes that (i) don't expect them for certain keyspans, and (ii) don't know to upgrade them to efficient epoch-based ones. While here, we also introduce a (hidden, default=true) cluster setting kv.transfer_expiration_leases_first.enabled to feature gate this protocol change. Co-authored-by: Kyle Patron <kyle@cockroachlabs.com> Co-authored-by: Stephanie Bodoff <stephanie@cockroachlabs.com> Co-authored-by: irfan sharif <irfanmahmoudsharif@gmail.com>
- Loading branch information
Showing
36 changed files
with
2,085 additions
and
22 deletions.
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| alter_func_stmt ::= | ||
| alter_func_options_stmt | ||
| | alter_func_rename_stmt | ||
| | alter_func_owner_stmt | ||
| | alter_func_set_schema_stmt | ||
| | alter_func_dep_extension_stmt | ||
| ( 'ALTER' 'FUNCTION' function_with_argtypes ( ( ( 'CALLED' 'ON' 'NULL' 'INPUT' | 'RETURNS' 'NULL' 'ON' 'NULL' 'INPUT' | 'STRICT' | 'IMMUTABLE' | 'STABLE' | 'VOLATILE' | 'LEAKPROOF' | 'NOT' 'LEAKPROOF' ) ) ( ( ( 'CALLED' 'ON' 'NULL' 'INPUT' | 'RETURNS' 'NULL' 'ON' 'NULL' 'INPUT' | 'STRICT' | 'IMMUTABLE' | 'STABLE' | 'VOLATILE' | 'LEAKPROOF' | 'NOT' 'LEAKPROOF' ) ) )* ) ( 'RESTRICT' | ) ) | ||
| | ( 'ALTER' 'FUNCTION' function_with_argtypes 'RENAME' 'TO' name ) | ||
| | ( 'ALTER' 'FUNCTION' function_with_argtypes 'OWNER' 'TO' role_spec ) | ||
| | ( 'ALTER' 'FUNCTION' function_with_argtypes 'SET' 'SCHEMA' schema_name ) | ||
| | ( 'ALTER' 'FUNCTION' function_with_argtypes ( 'NO' | ) 'DEPENDS' 'ON' 'EXTENSION' name ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| create_func_stmt ::= | ||
| 'CREATE' opt_or_replace 'FUNCTION' func_create_name '(' opt_func_arg_with_default_list ')' 'RETURNS' opt_return_set func_return_type opt_create_func_opt_list opt_routine_body | ||
| 'CREATE' ( 'OR' 'REPLACE' | ) 'FUNCTION' func_create_name '(' ( ( ( ( func_arg | func_arg | func_arg ) ) ( ( ',' ( func_arg | func_arg | func_arg ) ) )* ) | ) ')' 'RETURNS' ( | ) ( func_arg_type ) ( ( ( ( 'AS' func_as | 'LANGUAGE' 'SQL' | ( 'CALLED' 'ON' 'NULL' 'INPUT' | 'RETURNS' 'NULL' 'ON' 'NULL' 'INPUT' | 'STRICT' | 'IMMUTABLE' | 'STABLE' | 'VOLATILE' | 'LEAKPROOF' | 'NOT' 'LEAKPROOF' ) ) ) ( ( ( 'AS' func_as | 'LANGUAGE' 'SQL' | ( 'CALLED' 'ON' 'NULL' 'INPUT' | 'RETURNS' 'NULL' 'ON' 'NULL' 'INPUT' | 'STRICT' | 'IMMUTABLE' | 'STABLE' | 'VOLATILE' | 'LEAKPROOF' | 'NOT' 'LEAKPROOF' ) ) ) )* ) | ) opt_routine_body |
Oops, something went wrong.