linkedin / linkedin/venice

[Feature] Allow DynamicAccessController to access the HTTP Request headers in order to implement JWT token authentication

Open
#202 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Java
Stars
611
Forks
124
Avg merge
3d 1h
Merged PRs (30d)
26

Description

### Willingness to contribute

Yes. I can contribute a fix for this bug independently.

### Feature Request Proposal

My understanding from code is that the Router, the Controller and the Server expose an HTTP endpoint.
In this case implementing token based authentication (like JWT) is pretty easy, because we can simply require the client to pass the token in a HTTP header.

The only thing we need to do is to allow the DynamicAccessController to access the HTTP request headers (and possibly cache the result of the validation but attaching it to the Netty Channel)

The implementation on the clients should be pretty straighforward, as we only need to let the users configure the token and pass it in every HTTP request as an header

### Motivation

> #### What is the use case for this feature?

Implementing JWT authentication (and some day also OAuth2)

### Details

_No response_

### What component(s) does this bug affect?

- [X] `Controller`: This is the control-plane for Venice. Used to create/update/query stores and their metadata.
- [X] `Router`: This is the stateless query-routing layer for serving read requests.
- [X] `Server`: This is the component that persists all the store data.
- [X] `VenicePushJob`: This is the component that pushes derived data from Hadoop to Venice backend.
- [X] `Thin Client`: This is a stateless client users use to query Venice Router for reading store data.
- [X] `Fast Client`: This is a stateful client users use to query Venice Server for reading store data.
- [X] `Da Vinci Client`: This is an embedded, stateful client that materializes store data locally.
- [X] `Samza`: This is the library users use to make nearline updates to store data.
- [X] `Admin Tool`: This is the stand-alone client used for ad-hoc operations on Venice.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Trace how DynamicAccessController is invoked by the Router, Controller, and Server, then identify where HTTP request headers are available. Define how header access and any validation result should be exposed to the controller, and verify that JWT authentication can be implemented consistently across the affected HTTP endpoints.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, authentication, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.