IMPALA-12232: Validate JWT aud/iss claims Validate configured audienceClaims and issuerClaims after token signature verification for both JWT and OAuth auth flows, including HS2 HTTP and webserver paths. Extend oauth_servers parsing to accept audienceClaims/issuerClaims and align claim validation behavior with JWT RFC requirements for aud/iss semantics. Address follow-up review feedback by adding targeted null checks, preserving HTTP error response headers in test transport code, and strengthening JwtHttp negative tests to assert claim-specific auth failures from WWW-Authenticate headers. Remove obsolete --jwt_validate_signature usage in JwtHttpTest startup flags so custom-cluster tests use supported oauth_servers options. Testing: - Linux: fe mvn test -Dtest='JwtHttpTest#testJwtAuthWithWrongIssuerClaim+ testJwtAuthWithWrongAudienceClaim+testJwtAuthWithMissingAudienceClaim' - Linux: be/build/debug/util/oauth-server-config-test Change-Id: I0a00b126359f2bc7e2f73d894cebc2b9014c7375 Assisted-by: GPT-5.3 (Cursor) Reviewed-on: http://gerrit.cloudera.org:8080/24472 Tested-by: Impala Public Jenkins <impala-public-jenkins@cloudera.com> Reviewed-by: Jason Fehr <jfehr@cloudera.com>
Lightning-fast, distributed SQL queries for petabytes of data stored in open data and table formats.
Impala is a modern, massively-distributed, massively-parallel, C++ query engine that lets you analyze, transform and combine data from a variety of data sources:
The fastest way to try out Impala is a quickstart Docker container. You can try out running queries and processing data sets in Impala on a single machine without installing dependencies. It can automatically load test data sets into Apache Kudu and Apache Parquet formats and you can start playing around with Apache Impala SQL within minutes.
To learn more about Impala as a user or administrator, or to try Impala, please visit the Impala homepage. Detailed documentation for administrators and users is available at Apache Impala documentation.
If you are interested in contributing to Impala as a developer, or learning more about Impala's internals and architecture, visit the Impala wiki.
Impala only supports Linux at the moment. Impala supports x86_64 and arm64 (as of Impala 4.4). Impala Requirements contains more detailed information on the minimum CPU requirements.
Impala runs on Linux systems only. The supported distros are
Other systems, e.g. SLES15/16, may also be supported but are not tested by the community.
This distribution uses cryptographic software and may be subject to export controls. Please refer to EXPORT_CONTROL.md for more information.
See Impala's developer documentation to get started.
Detailed build notes has some detailed information on the project layout and build.