[rest] Add pluggable signer architecture for REST API authentication #7100
Conversation
sundapeng
force-pushed
the
dlf-pop-signer
branch
8 times, most recently
from
fa19e4b to
d5b4b50
Compare
sundapeng
force-pushed
the
dlf-pop-signer
branch
from
d5b4b50 to
01e48b9
Compare
sundapeng
changed the title
sundapeng
changed the title
docs/content/concepts/rest/dlf.md
Outdated
| Paimon supports multiple signing algorithms for DLF authentication. You can configure the signing algorithm explicitly, | ||
| or let Paimon automatically select it based on the endpoint host. | ||
|
|
||
| ### Automatic Selection (Recommended) |
There was a problem hiding this comment.
DLF Default Signing (Recommended)
There was a problem hiding this comment.
DLF Default Signing (Recommended)
Hi @JingsongLi , Here's a background: Each endpoint URI can only use the specific signer, so introduce the auto-selection:
- For domain names containing "dlfnext", the OpenAPI signing is selected by default.
- For other domain names, the default signing is selected by default.
For dlfnext endpoint, default signer is not work. "DLF Default Signing is Recommended" may be misleading.
There was a problem hiding this comment.
If automatic derivation works well, is it necessary for us to expose this configuration?
There was a problem hiding this comment.
All known scenarios don't require configuring it, but it's hard to guarantee the OpenAPI infrastructure won't change in the future.
There was a problem hiding this comment.
It is OK to introduce it, it is not necessary to document it.
paimon-api/src/main/java/org/apache/paimon/rest/RESTCatalogOptions.java
Outdated
Show resolved
Hide resolved
|
+1 |
2 participants
Purpose
This PR refactors the REST API authentication mechanism to support multiple signing algorithms through a pluggable architecture.
Key changes:
DLFRequestSignerinterface to abstract signing behaviorDLFDefaultSigner: Original DLF signing algorithm (DLF4-HMAC-SHA256)DLFOpenApiSigner: New OpenAPI signing algorithm for AlibabaCloud OpenAPI endpoints(dlfnext)DLFAuthProviderFactoryBenefits:
Tests
DLFRequestSignerTestwith comprehensive test coverageMockRESTCatalogTestandAuthProviderTestAPI and Format
No API or storage format changes.
Documentation
DLFDefaultSignerandDLFOpenApiSigner