[improvement](fe) Support LDAP default roles#63411
Merged
Merged
Conversation
Issue Number: N/A
Related PR: N/A
Problem Summary: LDAP temporary users could only receive roles mapped from LDAP groups and the built-in information_schema-only role. Add ldap_default_roles so every LDAP-authenticated user can receive configured Doris roles while still keeping LDAP group roles.
Support configuring default Doris roles for LDAP-authenticated users through ldap_default_roles.
- Test: Unit Test
- Ran `env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run 'org.apache.doris.mysql.authenticate.ldap.LdapManagerTest#testGetUserInfoWithLdapDefaultRoles'`
- Ran `env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run org.apache.doris.mysql.authenticate.ldap.LdapManagerTest`
- Ran `env JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home /Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn checkstyle:check -pl fe-core`
- Behavior changed: Yes. LDAP-authenticated users can receive configured default Doris roles in addition to LDAP group roles, and online updates of ldap_default_roles refresh LDAP user cache.
- Does this need documentation: Yes. Added ldap.conf template entry.
Jungzhang
requested review from
CalvinKirs,
dataroaring and
morningman
as code owners
Contributor
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
Contributor
Author
|
run buildall |
6 tasks
Contributor
TPC-H: Total hot run time: 31028 ms |
Contributor
TPC-DS: Total hot run time: 170218 ms |
Contributor
FE Regression Coverage ReportIncrement line coverage |
Contributor
Author
|
run feut |
Contributor
Author
|
run nonConcurrent |
Contributor
Author
|
@morningman PTAL when you have time. Could you also help trigger |
Contributor
FE Regression Coverage ReportIncrement line coverage |
Contributor
Author
|
@morningman CI is green now. Could you help trigger |
Contributor
Author
|
@CalvinKirs @dataroaring CI is green now. Could either of you help trigger |
seawinde
reviewed
May 27, 2026
Jungzhang
added a commit
to Jungzhang/doris
that referenced
this pull request
May 28, 2026
### What problem does this PR solve? Issue Number: N/A Related PR: apache#63411 Problem Summary: LDAP default roles should avoid broadening privileges for users that already have LDAP group-derived Doris roles by default. Add ldap_always_apply_default_roles so ldap_default_roles are fallback-only by default, while still allowing additive default roles when explicitly enabled. ### Release note Support configuring whether LDAP default roles are applied as fallback-only or always added. ### Check List (For Author) - Test: - Manual test: `git diff --cached --check` - Manual test: `env JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home /Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn checkstyle:check -pl fe-common,fe-core` from `fe/` - Unit Test: Tried `env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run 'org.apache.doris.mysql.authenticate.ldap.LdapManagerTest'`, but it failed before test execution because `thirdparty/installed/bin/protoc` is missing. - Behavior changed: Yes. By default, ldap_default_roles are applied only when no LDAP group-derived Doris role exists. Setting ldap_always_apply_default_roles=true keeps the additive behavior. - Does this need documentation: Yes. Updated ldap.conf template.
### What problem does this PR solve?
Issue Number: N/A
Related PR: N/A
Problem Summary: Add FE unit coverage for LDAP default role behavior. The tests verify that blank LDAP default role entries are ignored while valid LDAP group and default roles are preserved, and that online updates of ldap_default_roles refresh LDAP user cache through Env.setMutableConfigWithCallback.
### Release note
None
### Check List (For Author)
- Test: Unit Test
- Ran `env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --coverage --run 'org.apache.doris.mysql.authenticate.ldap.LdapManagerTest,org.apache.doris.catalog.EnvTest'`
- Behavior changed: No
- Does this need documentation: No
Jungzhang
force-pushed
the
ldap-default-roles
branch
from
02bbd75 to
c5017be
Compare
Contributor
Author
|
run buildall |
Contributor
TPC-H: Total hot run time: 31894 ms |
Contributor
TPC-DS: Total hot run time: 172593 ms |
Contributor
FE Regression Coverage ReportIncrement line coverage |
Contributor
Author
|
run feut |
Contributor
FE UT Coverage ReportIncrement line coverage |
Contributor
Author
|
@seawinde I've added more tests as requested. Could you please take another look when you have time? Thanks. |
Contributor
|
/review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Reviewed the PR changes for LDAP default roles and dynamic config cache refresh. I did not find any additional blocking issue beyond the already-open thread about whether ldap_default_roles should be additive for every LDAP user or fallback-only when no LDAP group role maps to a Doris role.
Critical checkpoint conclusions:
- Goal/test: The change adds ldap_default_roles and refreshes LDAP cache on online updates. The implementation and added FE unit tests cover additive default-role behavior, blank/missing default role entries, missing LDAP group role behavior, and config-update cache refresh.
- Scope: The code change is small and focused on LDAP config, LDAP role collection, and targeted tests/docs.
- Concurrency/lifecycle: LdapManager cache mutation remains under its existing read/write lock. The mutable config update clears the LDAP cache after ConfigBase updates the static config, which is the intended lifecycle for recomputing cached LDAP users. No new lock-order or catalog-lock interaction issue found.
- Configuration: ldap_default_roles is declared mutable, is parsed through existing String[] config handling, and the new Env callback refreshes cached LDAP users after online updates.
- Compatibility/persistence: No storage format, RPC, thrift, or EditLog compatibility impact found; this is FE runtime/config behavior only.
- Parallel paths: LDAP group role resolution and configured default role resolution both use existing Auth role lookup semantics; no separate BE/cloud path applies.
- Tests/results: The added FE unit coverage is relevant. I did not run tests in this review runner.
- Observability: Missing configured default roles are logged with a warning; no additional metrics appear necessary for this small auth config path.
- Data correctness/transactions: No committed-data visibility, version, delete-bitmap, or transaction persistence path is involved.
- Performance: Role lookup work is proportional to LDAP group count plus configured default role count and cached per LDAP user as before; no hot-path regression found.
User focus: No additional user-provided review focus was supplied.
morrySnow
approved these changes
Jun 2, 2026
github-actions
Bot
added
the
approved
Contributor
|
PR approved by at least one committer and no changes requested. |
Contributor
|
PR approved by anyone and no changes requested. |
morrySnow
pushed a commit
to apache/doris-website
that referenced
this pull request
Jun 2, 2026
## Related PR - Code PR: apache/doris#63411 ## Versions - [x] dev - [ ] 4.x - [ ] 3.x - [ ] 2.1 ## Languages - [x] Chinese - [x] English ## Summary Adds documentation for `ldap_default_roles`, which allows Doris to grant configured default roles to every LDAP-authenticated user. The update explains: 1. How `ldap_default_roles` differs from the built-in `ldapDefaultRole`. 2. How default LDAP roles are merged with LDAP group roles and existing Doris user privileges. 3. That roles configured in `ldap_default_roles` must already exist in Doris. 4. How to configure `ldap_default_roles` in `ldap.conf`. 5. How to update `ldap_default_roles` online with `ADMIN SET FRONTEND CONFIG`. 6. That online updates of `ldap_default_roles` refresh the LDAP user cache automatically. ## Files - `docs/admin-manual/auth/authentication/ldap.md` - `i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authentication/ldap.md`
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this PR solve?
Issue Number: N/A
Related PR: N/A
Problem Summary:
LDAP temporary users could only receive roles mapped from LDAP groups and the built-in information_schema-only role. This PR adds
ldap_default_rolesso every LDAP-authenticated user can receive configured Doris roles while still keeping LDAP group roles.Release note
Support configuring default Doris roles for LDAP-authenticated users through
ldap_default_roles.Check List (For Author)
Test
env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run 'org.apache.doris.mysql.authenticate.ldap.LdapManagerTest#testGetUserInfoWithLdapDefaultRoles'env PATH=/private/tmp/doris-brew-shim:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin FE_UT_PARALLEL=1 JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home CUSTOM_MVN=/Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn ./run-fe-ut.sh --run org.apache.doris.mysql.authenticate.ldap.LdapManagerTestenv JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-17.jdk/Contents/Home /Users/zhanggen/.m2/wrapper/dists/apache-maven-3.9.5-bin/32db9c34/apache-maven-3.9.5/bin/mvn checkstyle:check -pl fe-coreBehavior changed:
ldap_default_rolesrefresh the LDAP user cache.Does this need documentation?
Check List (For Reviewer who merge this PR)