opensearch-project / opensearch-project/sql-jdbc

[FEATURE] Support preemptive basic auth in JDBC driver

Open
#28 9 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

catch-all acknowledged enhancement
Dominant language
Java
Stars
28
Forks
39
PR merge metrics
No merged PRs in 30d

Description

Is your feature request related to a problem?
Currently basic auth is non-preemptive that expect an authenticate header (WWW-Authenticate: Basic ...) from the server. There is problem when server responds something else, for example, an OpenSearch cluster with SAML enabled returns WWW-Authenticate: X-Security-IdP instead. This fails the basic auth request with a 401 HTTP error.

What solution would you like?
One solution is switch to preemptive auth and enforce it all the time. The impact of this needs to be evaluated carefully.

What alternatives have you considered?
Alternatively, provide a configuration for user to choose which auth mode to use. This may be safer and more flexible option compared with enforcing preemptive auth.

Do you have any additional context?

  1. Non-/Preemptive process in brief: https://stackoverflow.com/questions/7482523/preemptive-authentication-why
  2. The HTTP RFC: https://datatracker.ietf.org/doc/html/rfc2617
  3. Sample HTTP 401 error as below
HttpResponseProxy{HTTP/1.1 401 Unauthorized [Date: Thu, 23 Jun 2022 17:22:31 GMT, Content-Type: text/plain;charset=UTF-8, Content-Length: 0, Connection: keep-alive, Access-Control-Allow-Origin: *, WWW-Authenticate: X-Security-IdP realm="OpenSearch Security"

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the JDBC driver's authentication flow and how it handles the reported HTTP 401 response. The issue does not name files or tests and leaves the choice between enforced preemptive authentication and a user configuration unresolved; done would require an agreed authentication behavior with coverage for the OpenSearch SAML response case.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
database
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.