apache / apache/gravitino

[Bug report] Web V2 does not support built-in Basic authentication login in Gravitino 1.3.0

Open
#12,466 1 comment 0 reactions 0 assignees View on GitHub
2.0.0 bug
Dominant language
Java
Stars
3.2k
Forks
935
Avg merge
1d 16h
Merged PRs (30d)
298

Description

### Version

main branch

### Describe what's wrong

## Description

Apache Gravitino 1.3.0 supports the built-in IdP and Basic authentication, but Web V2 does not provide a username/password login flow when `gravitino.authenticators=basic`.

Instead, `/ui/login` displays an OAuth client-credentials form with these fields:

- Grant Type
- Client ID
- Client Secret
- Scope

As a result, a built-in IdP user cannot log in to Web V2 with a username and password.

This is reproducible when accessing Gravitino directly, without Apache Knox or another reverse proxy.

## Expected behavior

When `gravitino.authenticators=basic`, Web V2 should:

1. Display username and password fields.
2. Authenticate with an HTTP Basic `Authorization` header.
3. Keep the authenticated state for subsequent API requests.
4. Not display OAuth client-credentials fields.

### Error message and/or stacktrace

No server-side stack trace is produced when the login page is opened.

The visible UI problem is that `/ui/login` renders the OAuth client-credentials form instead of a Basic username/password form:

```text
Grant Type: client_credentials
Client ID:
Client Secret:
Scope:
```

Therefore the configured built-in administrator credentials cannot be entered through Web V2.

### How to reproduce

1. Use Apache Gravitino 1.3.0.
2. Enable Web V2:
```bash
export GRAVITINO_USE_WEB_V2=true
```
3. Configure the built-in Basic authenticator:
```properties
gravitino.authenticators=basic
gravitino.server.rest.extensionPackages=org.apache.gravitino.idp.web.rest.feature
gravitino.authorization.serviceAdmins=admin
```
4. Before the first startup, configure a valid initial administrator password:
```bash
export GRAVITINO_INITIAL_ADMIN_PASSWORD=''
```
5. Start Gravitino.
6. Open the Web V2 login page directly:
```text
http://:8090/ui/login
```
7. Observe that the page asks for OAuth client credentials rather than a Basic username and password.

### Additional context

Environment:

- Apache Gravitino: 1.3.0
- Web UI: Web V2
- Java: JDK 17
- Browser: Chrome
- Access method: direct Gravitino Web UI

During investigation, `web-v2/web/src/lib/provider/session.js` appeared to contain authentication handling for `simple` and `oauth`, but no complete Web V2 login path for `basic`.

The Basic REST authentication mechanism is documented for Gravitino 1.3.0. This report is specifically about the missing Web V2 username/password login flow.

Contributor guide

Open the contributing guide

Research direction

Start with web-v2/web/src/lib/provider/session.js and the /ui/login flow, then reproduce the issue using gravitino.authenticators=basic and direct Web V2 access. Done means the page accepts username and password, authenticates with HTTP Basic, preserves authentication for subsequent API requests, and no longer shows OAuth client-credentials fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.