tree 8d06039289896c6ffaf9f5195a55fffacb73222d
parent 5080424abbd7cee0f603ede10ab8dbf29ec10c85
author Charles S. Givre <cgivre@apache.org> 1651018537 -0400
committer GitHub <noreply@github.com> 1651018537 -0400
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJiaIspCRBK7hj4Ov3rIwAAJPUIAB2uKWKTRhT0CTH6eXJNNQjk
 W1w/Y+zXZMro5eHlnV7cAxLh6D9Xps1zxC2ikJy1qsb37igOnkuKdllXxd1Q+v1E
 MHNHhP/g5UL9lFokNZ+paflfsTHexWrW9EToQ7QYDJd8UruQr3EH+cjazHskv8Rb
 TU8VkOSKQ0jCjz/kW7tnQhO+TBLbQiCr7CCi7gDrCn6N1xOkm8dCOnGVsEAxD1Dp
 SFmNZtenitNMYzb+tpTETYCWV+aeC3QAFfnt4H7oQrxKjne0hZ8y/opefJ+kDRMk
 7gHfvAv4tjXUHyicthEjE9UxR189xKLL3mCYk3n8eiOG7D4mz28ndd1+d4OMk3s=
 =C6sP
 -----END PGP SIGNATURE-----
 

DRILL-8155: Introduce New Plugin Authentication Modes (#2516)

* Do not set the read-only hint on JDBC connections.

* Outline of different auth modes in storage-jdbc.

In this commit, a new `authMode` storage config supporting three new auth modes
is defined: shared user (default), user translation (user is translated to some
other user from the external storage) and impersonation (the external storage
and JDBC driver provide support for impersonating the Drill query user).

The JdbcStoragePlugin is enhanced to be able to work with a lookup table of
connection pools, where a pool is dedicated to each query user except when
in shared user auth mode.

Planning and execution time APIs are also enhanced to transmit a user
credentials object for the query user, instead of just its username.
This allows for the expansion of the UserCredentials protobuf type to
include some optional extra credentials, e.g. in an array of byte arrays.
These credentials may be relevant in the user tranlsation mode when a
credential provider must be accessed in order to obtain the creds to be used
for the external system.

* Rebased to current master and build fixes

* Build works, cred stuff added

* Credentials being saved and pushed down to storage plugin

* UI now closing properly

* User Translation working for HTTP plugin

* HTTP unit tests passing

* WIP

* Fixed import

* User Credentials now being stored in credential provider

* Working

* Fixed TPCH Unit Tests

* Fix CredProvider SerDe Test

* Added unit tests for JDBC

* Code cleanup

* Fix LGTM alerts

* Correct username now populating Group Scan

* Username to Subscan

* Remove PerUserUsernamePasswordCredentials class.

* Remove getUserCredentials from CredentialsProvider.

* Planning errors fixed

* Removed unused imports

* Fixed minor issues

* Unit test fixes

* WIP.

* Fix CodeQL Alert

* Ignore LGTM False Positive

* Fix tainted string LGTM alert

* Revert LGTM Comment

* Addressed review comments

* Use fixed size Guava caches in JDBC convetion and dialect factories.

These replace Maps with no size limit that might have grown without
bound. LRU eviction begins when the cache size limit is reached.

* Add a TTL to the JDBC dialect and convention caches.

Co-authored-by: James Turton <james@somecomputer.xyz>