Relax `client_id`, `client_secret` regex/pattern validation on reset endpoint call by rmannibucau · Pull Request #3276 · apache/polaris

rmannibucau · 2025-12-15T21:30:52Z

client_id/client_secret patterns are validated when calling reset endpoint but the pattern is hardcoded which can be too rigid.
this PR just enables to configure it.

Checklist

🛡️ Don't disclose security issues! (contact security@apache.org)
🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
🧪 Added/updated tests with good coverage, or manually tested (and explained how)
💡 Added comments for complex logic
🧾 Updated CHANGELOG.md (if needed)
📚 Updated documentation in site/content/in-dev/unreleased (if needed)

dimas-b

Thanks for your contribution, @rmannibucau ! Please see my comment about not performing these checks. If you agree, the other comments can be ignored.

dimas-b · 2025-12-15T22:10:44Z

polaris-core/src/main/java/org/apache/polaris/core/config/PolarisConfiguration.java

 */
 public abstract class PolarisConfiguration<T> {
-
-  private static final Logger LOGGER = LoggerFactory.getLogger(PolarisConfiguration.class);


nit: if you find "dead code", it's generally preferable to cleanup in a dedicated PR and avoid mixing cleanup with feature changes :)

dimas-b · 2025-12-15T22:12:19Z

runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisServiceImpl.java

  private void validateClientId(String clientId) {
-    if (!clientId.matches("^[0-9a-f]{16}$")) {
+    if (!clientId.matches(
+        realmConfig.getConfig(FeatureConfiguration.CREDENTIAL_RESET_CLIENT_ID_PATTERN))) {


we should validate the value of CREDENTIAL_RESET_CLIENT_ID_PATTERN on startup to avoid deferred RegEx syntax errors (it's an admin mistake, not the API client's mistake)

Hmm, it will be per realm so no sure it can be done at startup properly, do you have a code pointer in mind? would bootstrap realm fulfill your expectation?

default is known valid - same as before, it is hardcoded

Cf.

polaris/runtime/service/src/main/java/org/apache/polaris/service/config/ProductionReadinessChecks.java

Line 142 in 1aa95de

public ProductionReadinessCheck checkTokenBrokers(AuthenticationConfiguration configuration) {

hmm, not sure i'm a fan of this one, feature is quite specific and we would make the realm down for it? 🤔

let's drop the validation for now then

dimas-b · 2025-12-15T22:16:32Z

runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisServiceImpl.java

  private void validateClientSecret(String clientSecret) {
-    if (!clientSecret.matches("^[0-9a-f]{32}$")) {
+    if (!clientSecret.matches(
+        realmConfig.getConfig(FeatureConfiguration.CREDENTIAL_RESET_CLIENT_SECRET_PATTERN))) {


If validating client ID/secret format is becoming a nuisance to users, from my POV this check can just be removed completely. I do not think Polaris code relies on these values following a particular format.

If backward compatibility is a concern, I'd rather add a simple boolean flag to disable these checks (defaulting to enabled). WDYT?

I'm fine dropping the feature (the two validateClientX methods) too

+1 to @dimas-b suggestion.

Let's try removing the checks completely and get some more reviews. If people raise concerns we can add an on/off flag then.

dimas-b · 2025-12-16T20:03:00Z

runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisServiceImplTest.java

    }
  }
+
+  private PolarisServiceImpl noAdminResetCredentialPolarisService() {


Is this method still used?

dimas-b

Code change LGTM 👍 The PR title probably needs to be adjusted now 🙂

github-actions · 2026-01-17T02:12:38Z

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

dimas-b · 2026-01-19T17:34:05Z

@rmannibucau : sorry that this PR got forgotten. I think it still makes sense to merge it. Could you resolve conflicts, please?

rmannibucau · 2026-01-19T22:21:56Z

@dimas-b sure, done

…dpoint call (apache#3276) client_id/client_secret patterns are validated when calling reset endpoint but the pattern is hardcoded which can be too rigid.

* Use injected RealmConfig in JdbcMetaStoreManagerFactory (apache#3412) * Use injected RealmConfig in JdbcMetaStoreManagerFactory * Improve code isolation by using `RealmConfig` (like most other code) instead of the lower-level `PolarisConfigurationStore` * This also enabled proper CDI request-scoped injection in concert with apache#3411 * Additionally, this enables further code cleanup in `PolarisConfigurationStore` as discussed in apache#3324 with the goal of using this interface for the backend configuration code, while `RealmConfig` becomes the corresponding frontend interface. * Fix `ServiceProducers.realmConfig()` to make a `RealmConfigImpl` directly from its dependencies (not from `CallContext`) to avoid cycles in CDI. * Fix renovate syntax (apache#3471) * Remove client_id, client_secret regex/pattern validation on reset endpoint call (apache#3276) client_id/client_secret patterns are validated when calling reset endpoint but the pattern is hardcoded which can be too rigid. * Use typed config for `TABLE_METADATA_CLEANUP_BATCH_SIZE` (apache#3478) Add a typed `FeatureConfiguration` with the same config name and default value. * chore(deps): update docker.io/adobe/s3mock docker tag to v4.11.0 (apache#3492) * fix(deps): update dependency io.smallrye.config:smallrye-config-core to v3.15.1 (apache#3490) * fix(deps): update dependency ch.qos.logback:logback-classic to v1.5.25 (apache#3489) * chore(deps): update plugin com.gradle.develocity to v4.3.1 (apache#3452) * Last merged commit 738bce9 --------- Co-authored-by: Dmitri Bourlatchkov <dmitri.bourlatchkov@gmail.com> Co-authored-by: Yong Zheng <yongzheng0809@gmail.com> Co-authored-by: Romain Manni-Bucau <rmannibucau@gmail.com> Co-authored-by: Mend Renovate <bot@renovateapp.com>

github-project-automation bot added this to Basic Kanban Board Dec 15, 2025

github-project-automation bot moved this to PRs In Progress in Basic Kanban Board Dec 15, 2025

dimas-b reviewed Dec 15, 2025

View reviewed changes

rmannibucau force-pushed the dev/make-client-id-secret-pattern-configurable branch from 548e086 to cd0bd7c Compare December 16, 2025 18:02

dimas-b reviewed Dec 16, 2025

View reviewed changes

rmannibucau force-pushed the dev/make-client-id-secret-pattern-configurable branch 2 times, most recently from b842b06 to 8dfbac6 Compare December 16, 2025 22:00

dimas-b approved these changes Dec 17, 2025

View reviewed changes

github-project-automation bot moved this from PRs In Progress to Ready to merge in Basic Kanban Board Dec 17, 2025

rmannibucau changed the title ~~Ensure client_id/client_secret patterns are configurable~~ Ensure client_id/client_secret patterns are not enforced as before Dec 17, 2025

github-actions bot added the Stale label Jan 17, 2026

dimas-b changed the title ~~Ensure client_id/client_secret patterns are not enforced as before~~ Relax client_id, client_secret regex/pattern validation on reset endpoint call Jan 19, 2026

dimas-b previously approved these changes Jan 19, 2026

View reviewed changes

dimas-b removed the Stale label Jan 19, 2026

merge

49afa41

rmannibucau dismissed dimas-b’s stale review via 49afa41 January 19, 2026 22:21

rmannibucau force-pushed the dev/make-client-id-secret-pattern-configurable branch from 8dfbac6 to 49afa41 Compare January 19, 2026 22:21

dimas-b approved these changes Jan 19, 2026

View reviewed changes

dimas-b merged commit 7bd71e0 into apache:main Jan 19, 2026
15 checks passed

github-project-automation bot moved this from Ready to merge to Done in Basic Kanban Board Jan 19, 2026

rmannibucau deleted the dev/make-client-id-secret-pattern-configurable branch January 20, 2026 09:41

Conversation

rmannibucau commented Dec 15, 2025

Checklist

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 17, 2026

Uh oh!

dimas-b commented Jan 19, 2026

Uh oh!

rmannibucau commented Jan 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants