Skip to content

Commit 821ae4c

Browse files
aoiasdaoiasd
authored
enhance: [2.4] skip check source id (#45391)
pr: #45377 relate:#45381 Signed-off-by: aoiasd <[email protected]>
1 parent 5f9175f commit 821ae4c

File tree

5 files changed

+34
-97
lines changed

5 files changed

+34
-97
lines changed

‎internal/proxy/authentication_interceptor.go‎

Lines changed: 32 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -32,20 +32,6 @@ func parseMD(rawToken string) (username, password string) {
3232
return
3333
}
3434

35-
func validSourceID(ctx context.Context, authorization []string) bool {
36-
if len(authorization) < 1 {
37-
// log.Warn("key not found in header", zap.String("key", util.HeaderSourceID))
38-
return false
39-
}
40-
// token format: base64<sourceID>
41-
token := authorization[0]
42-
sourceID, err := crypto.Base64Decode(token)
43-
if err != nil {
44-
return false
45-
}
46-
return sourceID == util.MemberCredID
47-
}
48-
4935
func GrpcAuthInterceptor(authFunc grpc_auth.AuthFunc) grpc.UnaryServerInterceptor {
5036
return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
5137
var newCtx context.Context
@@ -76,48 +62,44 @@ func AuthenticationInterceptor(ctx context.Context) (context.Context, error) {
7662
if globalMetaCache == nil {
7763
return nil, merr.WrapErrServiceUnavailable("internal: Milvus Proxy is not ready yet. please wait")
7864
}
79-
// check:
80-
// 1. if rpc call from a member (like index/query/data component)
81-
// 2. if rpc call from sdk
65+
// check if rpc call from sdk
8266
if Params.CommonCfg.AuthorizationEnabled.GetAsBool() {
83-
if !validSourceID(ctx, md[strings.ToLower(util.HeaderSourceID)]) {
84-
authStrArr := md[strings.ToLower(util.HeaderAuthorize)]
67+
authStrArr := md[strings.ToLower(util.HeaderAuthorize)]
8568

86-
if len(authStrArr) < 1 {
87-
log.Warn("key not found in header")
88-
return nil, status.Error(codes.Unauthenticated, "missing authorization in header")
89-
}
69+
if len(authStrArr) < 1 {
70+
log.Warn("key not found in header")
71+
return nil, status.Error(codes.Unauthenticated, "missing authorization in header")
72+
}
9073

91-
// token format: base64<username:password>
92-
// token := strings.TrimPrefix(authorization[0], "Bearer ")
93-
token := authStrArr[0]
94-
rawToken, err := crypto.Base64Decode(token)
74+
// token format: base64<username:password>
75+
// token := strings.TrimPrefix(authorization[0], "Bearer ")
76+
token := authStrArr[0]
77+
rawToken, err := crypto.Base64Decode(token)
78+
if err != nil {
79+
log.Warn("fail to decode the token", zap.Error(err))
80+
return nil, status.Error(codes.Unauthenticated, "invalid token format")
81+
}
82+
83+
if !strings.Contains(rawToken, util.CredentialSeperator) {
84+
user, err := VerifyAPIKey(rawToken)
9585
if err != nil {
96-
log.Warn("fail to decode the token", zap.Error(err))
97-
return nil, status.Error(codes.Unauthenticated, "invalid token format")
86+
log.Warn("fail to verify apikey", zap.Error(err))
87+
return nil, status.Error(codes.Unauthenticated, "auth check failure, please check api key is correct")
9888
}
99-
100-
if !strings.Contains(rawToken, util.CredentialSeperator) {
101-
user, err := VerifyAPIKey(rawToken)
102-
if err != nil {
103-
log.Warn("fail to verify apikey", zap.Error(err))
104-
return nil, status.Error(codes.Unauthenticated, "auth check failure, please check api key is correct")
105-
}
106-
metrics.UserRPCCounter.WithLabelValues(user).Inc()
107-
userToken := fmt.Sprintf("%s%s%s", user, util.CredentialSeperator, util.PasswordHolder)
108-
md[strings.ToLower(util.HeaderAuthorize)] = []string{crypto.Base64Encode(userToken)}
109-
md[util.HeaderToken] = []string{rawToken}
110-
ctx = metadata.NewIncomingContext(ctx, md)
111-
} else {
112-
// username+password authentication
113-
username, password := parseMD(rawToken)
114-
if !passwordVerify(ctx, username, password, globalMetaCache) {
115-
log.Warn("fail to verify password", zap.String("username", username))
116-
// NOTE: don't use the merr, because it will cause the wrong retry behavior in the sdk
117-
return nil, status.Error(codes.Unauthenticated, "auth check failure, please check username and password are correct")
118-
}
119-
metrics.UserRPCCounter.WithLabelValues(username).Inc()
89+
metrics.UserRPCCounter.WithLabelValues(user).Inc()
90+
userToken := fmt.Sprintf("%s%s%s", user, util.CredentialSeperator, util.PasswordHolder)
91+
md[strings.ToLower(util.HeaderAuthorize)] = []string{crypto.Base64Encode(userToken)}
92+
md[util.HeaderToken] = []string{rawToken}
93+
ctx = metadata.NewIncomingContext(ctx, md)
94+
} else {
95+
// username+password authentication
96+
username, password := parseMD(rawToken)
97+
if !passwordVerify(ctx, username, password, globalMetaCache) {
98+
log.Warn("fail to verify password", zap.String("username", username))
99+
// NOTE: don't use the merr, because it will cause the wrong retry behavior in the sdk
100+
return nil, status.Error(codes.Unauthenticated, "auth check failure, please check username and password are correct")
120101
}
102+
metrics.UserRPCCounter.WithLabelValues(username).Inc()
121103
}
122104
}
123105
return ctx, nil

‎internal/proxy/authentication_interceptor_test.go‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -51,19 +51,6 @@ func TestValidAuth(t *testing.T) {
5151
assert.False(t, res)
5252
}
5353

54-
func TestValidSourceID(t *testing.T) {
55-
ctx := context.Background()
56-
// no metadata
57-
res := validSourceID(ctx, nil)
58-
assert.False(t, res)
59-
// illegal metadata
60-
res = validSourceID(ctx, []string{"invalid_sourceid"})
61-
assert.False(t, res)
62-
// normal sourceId
63-
res = validSourceID(ctx, []string{crypto.Base64Encode(util.MemberCredID)})
64-
assert.True(t, res)
65-
}
66-
6754
func TestAuthenticationInterceptor(t *testing.T) {
6855
ctx := context.Background()
6956
paramtable.Get().Save(Params.CommonCfg.AuthorizationEnabled.Key, "true") // mock authorization is turned on
@@ -87,11 +74,6 @@ func TestAuthenticationInterceptor(t *testing.T) {
8774
ctx = metadata.NewIncomingContext(ctx, md)
8875
_, err = AuthenticationInterceptor(ctx)
8976
assert.NoError(t, err)
90-
// with valid sourceId
91-
md = metadata.Pairs("sourceid", crypto.Base64Encode(util.MemberCredID))
92-
ctx = metadata.NewIncomingContext(ctx, md)
93-
_, err = AuthenticationInterceptor(ctx)
94-
assert.NoError(t, err)
9577

9678
{
9779
// wrong authorization style

‎internal/util/grpcclient/auth.go‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎internal/util/grpcclient/client.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,6 @@ import (
3939
"github.com/milvus-io/milvus/internal/util/sessionutil"
4040
"github.com/milvus-io/milvus/pkg/log"
4141
"github.com/milvus-io/milvus/pkg/tracer"
42-
"github.com/milvus-io/milvus/pkg/util"
43-
"github.com/milvus-io/milvus/pkg/util/crypto"
4442
"github.com/milvus-io/milvus/pkg/util/funcutil"
4543
"github.com/milvus-io/milvus/pkg/util/generic"
4644
"github.com/milvus-io/milvus/pkg/util/interceptor"
@@ -290,7 +288,6 @@ func (c *ClientBase[T]) connect(ctx context.Context) error {
290288
},
291289
MinConnectTimeout: c.DialTimeout,
292290
}),
293-
grpc.WithPerRPCCredentials(&Token{Value: crypto.Base64Encode(util.MemberCredID)}),
294291
grpc.FailOnNonTempDialError(true),
295292
grpc.WithReturnConnectionError(),
296293
grpc.WithDisableRetry(),
@@ -329,7 +326,6 @@ func (c *ClientBase[T]) connect(ctx context.Context) error {
329326
},
330327
MinConnectTimeout: c.DialTimeout,
331328
}),
332-
grpc.WithPerRPCCredentials(&Token{Value: crypto.Base64Encode(util.MemberCredID)}),
333329
grpc.FailOnNonTempDialError(true),
334330
grpc.WithReturnConnectionError(),
335331
grpc.WithDisableRetry(),

‎pkg/util/constant.go‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,8 @@ const (
4545
SegmentIndexPrefix = "segment-index"
4646
FieldIndexPrefix = "field-index"
4747

48-
HeaderAuthorize = "authorization"
49-
HeaderToken = "token"
50-
// HeaderSourceID identify requests from Milvus members and client requests
51-
HeaderSourceID = "sourceId"
52-
// MemberCredID id for Milvus members (data/index/query node/coord component)
53-
MemberCredID = "@@milvus-member@@"
48+
HeaderAuthorize = "authorization"
49+
HeaderToken = "token"
5450
CredentialSeperator = ":"
5551
UserRoot = "root"
5652
PasswordHolder = "___"

0 commit comments

Comments
 (0)