feat(pgwire): implement OAuth audience validation #23155
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yuhao-su
changed the title
yuhao-su
changed the title
|
Seems to solve the same issue as this one 🥵 : #23143 . |
8 tasks
yezizp2012
reviewed
Sep 10, 2025
| metadata: &HashMap<String, String>, | ||
| ) -> Result<bool, BoxedError> { | ||
| let header = decode_header(jwt)?; | ||
| let _header = decode_header(jwt)?; |
There was a problem hiding this comment.
Suggested change
| let _header = decode_header(jwt)?; |
yezizp2012
reviewed
Sep 10, 2025
| } | ||
|
|
||
| fn audience_from_cluster_id(cluster_id: &str) -> String { | ||
| format!("urn:risingwave:cluster:{}", cluster_id) |
There was a problem hiding this comment.
Please add a user-facing label to this PR, along with any necessary documentation. Especially the audience format, which will be used to generate the token.
With aud becoming a required field after this PR, Cloud must patch and deploy a version that generates tokens with the audience in the specified format, prior to any releases. Cc @xuhui-lu .
And @yuhao-su, we also need a way to expose the internal cluster_id to Cloud, perhaps via a SQL function.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I hereby agree to the terms of the RisingWave Labs, Inc. Contributor License Agreement.
What's changed and what's your intention?
This PR implements OAuth audience validation. Fixed #23126 .
Summary of changes:
aud) validation functionalityHow does this PR work:
The changes add validation logic to ensure that OAuth tokens contain the correct audience claim before accepting authentication.
Checklist
Documentation
Release note
https://docs.risingwave.com/sql/commands/sql-create-user
We need to update this page to tell users when use
oauth, the jwt should contains aaudclaim with valueurn:risingwave:cluster:your_cluster_id🤖 Generated with Claude Code