opensearch-project / opensearch-project/sql-jdbc
[FEATURE] Support preemptive basic auth in JDBC driver
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 28
- Forks
- 39
- PR merge metrics
- No merged PRs in 30d
Description
Is your feature request related to a problem?
Currently basic auth is non-preemptive that expect an authenticate header (WWW-Authenticate: Basic ...) from the server. There is problem when server responds something else, for example, an OpenSearch cluster with SAML enabled returns WWW-Authenticate: X-Security-IdP instead. This fails the basic auth request with a 401 HTTP error.
What solution would you like?
One solution is switch to preemptive auth and enforce it all the time. The impact of this needs to be evaluated carefully.
What alternatives have you considered?
Alternatively, provide a configuration for user to choose which auth mode to use. This may be safer and more flexible option compared with enforcing preemptive auth.
Do you have any additional context?
- Non-/Preemptive process in brief: https://stackoverflow.com/questions/7482523/preemptive-authentication-why
- The HTTP RFC: https://datatracker.ietf.org/doc/html/rfc2617
- Sample HTTP 401 error as below
HttpResponseProxy{HTTP/1.1 401 Unauthorized [Date: Thu, 23 Jun 2022 17:22:31 GMT, Content-Type: text/plain;charset=UTF-8, Content-Length: 0, Connection: keep-alive, Access-Control-Allow-Origin: *, WWW-Authenticate: X-Security-IdP realm="OpenSearch Security"
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the JDBC driver's authentication flow and how it handles the reported HTTP 401 response. The issue does not name files or tests and leaves the choice between enforced preemptive authentication and a user configuration unresolved; done would require an agreed authentication behavior with coverage for the OpenSearch SAML response case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- database
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100