Skip to content

Fix resourceName used in auth check for SupervisorsTable in SystemSchema#18985

Open
maytasm wants to merge 1 commit intoapache:masterfrom
maytasm:fix_resourcename_supervisor_security
Open

Fix resourceName used in auth check for SupervisorsTable in SystemSchema#18985
maytasm wants to merge 1 commit intoapache:masterfrom
maytasm:fix_resourcename_supervisor_security

Conversation

@maytasm
Copy link
Contributor

@maytasm maytasm commented Feb 4, 2026

Description

SupervisorsTable in SystemSchema (powering queries to the sys.supervisors table) was using the topic/stream of the supervisorSpec as the resourceName to authenticate against. This is wrong and is inconsistent with other APIs that uses the datasource name of the supervisor (i.e. updating supervisor spec, suspending/starting, querying, etc). This change fixes this to use the datasourceName and add test to verify that only datasourceName is use as resourceName in authentication.

This PR has:

  • been self-reviewed.
  • added documentation for new or modified features or behaviors.
  • a release note entry in the PR description.
  • added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
  • added or updated version, license, or notice information in licenses.yaml
  • added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
  • added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
  • added integration tests.
  • been tested in a test Druid cluster.

@maytasm maytasm force-pushed the fix_resourcename_supervisor_security branch from 843eead to 6cf4527 Compare February 4, 2026 10:11

Function<SupervisorStatus, Iterable<ResourceAction>> raGenerator = supervisor -> Collections.singletonList(
AuthorizationUtils.DATASOURCE_READ_RA_GENERATOR.apply(supervisor.getSource()));
AuthorizationUtils.DATASOURCE_READ_RA_GENERATOR.apply(supervisor.getDataSource()));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the java doc of orignial getSource says:

  /**
   * This API is only used for informational purposes in
   * org.apache.druid.sql.calcite.schema.SystemSchema.SupervisorsTable
   *
   * @return source like stream or topic name
   */
  String getSource();

Since here we' re using getDataSource I think we should remove the original getSource method definition. I check the code, besides the SystemSchema, there're few references in the the kafka supervisor spec, which can be replaced by calling getIoConfig().getStream()

Copy link
Contributor Author

@maytasm maytasm Feb 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think that's possible. getIoConfig is not a method of SupervisorSpec. It is only available in some (but not all) sub classes like KafkaSupervisorSpec but not CompactionSupervisorSpec. I think we still need this method

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants