Repository navigation
[2.0] fix(security): backend security hardening - #36656
mohityadav766 wants to merge 5 commits into
Conversation
…rovider tokens Tokens not signed with OpenMetadata's own key must name a configured client (clientId or oidcConfiguration.id) in their audience, carry the issuer from the provider's discovery document when the server-side client knows it, and, for a public Entra ID client whose authority names a tenant ID, come from that tenant. The discovery document is read on demand, so the server still starts while the provider is unreachable. The IT harness presents the ID token, as browsers do. Backport of the provider-token validation in #34967 and the tenant check in #36156. The rest of #34967 does not apply: 2.0 still mints its own token for confidential sign-ins.
Establish the login session only from the ID token the token endpoint returns for the callback's authorization code. Require the code whatever the response type is (the client redirects back in query mode, where providers return a code and never a token) and keep nothing else from the redirect. Backport of #35679 and of its follow-up on main. Test Login, which the follow-up also changed, does not exist on 2.0.
…change events A stored user carries its authentication mechanism: a person's password hash, or a bot's token. Reads withhold it; keep it out of every other way a user leaves the server. - Versions and history return user snapshots without it. - Listing change events requires an admin or a bot. - The authenticationMechanism definition in user.json is masked, so masked serialization of a user leaves it out, and the event recorded when users are seeded is serialized that way. - Create, PUT, PATCH, delete and restore return no mechanism for a person. A bot's response is unchanged. - The 2.0.8 post-data migration removes it from stored user events (MySQL and PostgreSQL). Backport of the snapshot redaction in #36156, the change-event listing check in #34838, and #36655.
❌ PR checklist incompleteThis PR cannot be merged until the following are addressed on its linked issue:
The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically. Maintainers can bypass this check by adding the |
github-actions
Bot
added
backend
safe to test
mohityadav766
changed the title
Code Review ✅ Approved🔴 High risk · Token audience, issuer, and tenant checks change authentication decisions, while credential-redaction migrations rewrite stored events and could reject valid sign-ins or alter historical data. Backport to 2.0 hardening identity-provider token validation (audience, issuer, tenant), restricts OIDC callbacks to the authorization code, and keeps user credentials out of responses, snapshots and change events. No issues found. VerificationRules No rules evaluated Functional validation Not enabledAuto-approval Not enabledFor more verification details, comment OptionsDisplay: compact → Showing compact verification results. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source |
|
Summary
Backport to 2.0 of backend security hardening, one commit per area:
Only what applies to 2.0 is carried. Each commit carries its own regression tests. Details are tracked internally.
🤖 Generated with Claude Code