Conversation
OAuth2ProxyAuthentication turns any "Authorization: Basic user:pass" header into a user without checking the password. That was fine while nginx in config-ui verified the credentials against ADMIN_USER/ADMIN_PASS before proxying, and the lake only kept the username for audit fields. apache#8854 put auth.RequireAuth behind it. With AUTH_ENABLED=true that gate now accepts the unverified Basic user, so any username:password pair reaches every non-public endpoint (blueprints, connections, pipelines) on a lake that is exposed directly. apache#8880 closed the same hole for X-Forwarded-User with FORWARDED_USER_SECRET but left the Basic branch untouched. Only consult the Basic header when AUTH_ENABLED is off, which is the legacy nginx mode. With AUTH_ENABLED the lake authenticates callers itself: session cookie, API key, or forwarded headers with the shared secret, exactly what auth.go already logs as the supported set. Upstream: not yet submitted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pr-type/bug-fix,pr-type/feature-development, etc.Summary
OAuth2ProxyAuthenticationturns anyAuthorization: Basic user:passintocommon.USERwithout checking the password. That was the contract of the nginx era: config-ui verified the credentials againstADMIN_USER/ADMIN_PASSand the lake kept the username for audit fields. #8854 putauth.RequireAuth()behind that middleware, so withAUTH_ENABLED=truethe unverified username now passes the terminal gate and anyuser:passreaches every non-public route on a directly exposed lake. #8880 fixed the siblingX-Forwarded-Userbranch withFORWARDED_USER_SECRETbut left this one.The change gates the Basic branch on
AUTH_ENABLEDbeing off (mirroringoidchelper.LoadConfig: unset counts as off). WithAUTH_ENABLED=truethe accepted callers are the onesauth.goalready logs as supported: session cookie, API key, forwarded headers with the shared secret. Legacy deployments withoutAUTH_ENABLEDkeep the Basic username exactly as before.Does this close any open issues?
Closes #9146
Other Information
Tests.
middlewares_basicauth_test.go: Basic header is ignored withAUTH_ENABLED=true, and is still taken as the user withAUTH_ENABLEDunset orfalse.newProxyAuthRouterin the existing forward-secret test gained aWithConfigvariant so both files share the router. The new bypass test fails onmainwithout the change.go build,go vetandgo test ./server/api/are clean aftermake mock. Running as a local patch on our v1.0.3-beta17 instance since 2026-09-17: Basic returns 401, OIDC sign-in and API-key callers unaffected.Behaviour change. A deployment that sets
AUTH_ENABLED=trueand still relies on config-ui nginx Basic auth for the lake will start getting 401 on the API. That combination was never a verified path (the lake trusted the header blindly);FORWARDED_USER_SECRETfrom #8880 is the supported way to pass a proxy-verified identity.Labels. I do not have permission to set them; this is
pr-type/bug-fix.