[#5968] fix(server-common): The owner of the catalog is incorrect whe…

…n using Basic Auth and Password is empty
apache · Dec 27, 2024 · 2567853 · 2567853
1 parent 2d160d1
commit 2567853
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 3 deletions.
diff --git a/...-common/src/main/java/org/apache/gravitino/server/authentication/SimpleAuthenticator.java b/...-common/src/main/java/org/apache/gravitino/server/authentication/SimpleAuthenticator.java
@@ -59,7 +59,7 @@ public Principal authenticateToken(byte[] tokenData) {
     try {
       String[] userInformation =
           new String(Base64.getDecoder().decode(credential), StandardCharsets.UTF_8).split(":");
-      if (userInformation.length != 2) {
+      if (userInformation.length < 1 || userInformation[0].isEmpty()) {
         return ANONYMOUS_PRINCIPAL;
       }
       return new UserPrincipal(userInformation[0]);

diff --git a/...mon/src/test/java/org/apache/gravitino/server/authentication/TestSimpleAuthenticator.java b/...mon/src/test/java/org/apache/gravitino/server/authentication/TestSimpleAuthenticator.java
@@ -47,11 +47,34 @@ public void testAuthentication() {
             .authenticateToken(
                 AuthConstants.AUTHORIZATION_BASIC_HEADER.getBytes(StandardCharsets.UTF_8))
             .getName());
+    String fullCredentials = "test-user:123";
+    String basicToken =
+        AuthConstants.AUTHORIZATION_BASIC_HEADER
+            + Base64.getEncoder().encodeToString(fullCredentials.getBytes(StandardCharsets.UTF_8));
+    Assertions.assertEquals(
+        fullCredentials.split(":")[0],
+        simpleAuthenticator
+            .authenticateToken(basicToken.getBytes(StandardCharsets.UTF_8))
+            .getName());
+    String credentialsOnlyHaveUsername = "test-user:";
+    basicToken =
+        AuthConstants.AUTHORIZATION_BASIC_HEADER
+            + Base64.getEncoder()
+                .encodeToString(credentialsOnlyHaveUsername.getBytes(StandardCharsets.UTF_8));
+    Assertions.assertEquals(
+        fullCredentials.split(":")[0],
+        simpleAuthenticator
+            .authenticateToken(basicToken.getBytes(StandardCharsets.UTF_8))
+            .getName());
+    String credentialsOnlyHavePassword = ":123";
+    basicToken =
+        AuthConstants.AUTHORIZATION_BASIC_HEADER
+            + Base64.getEncoder()
+                .encodeToString(credentialsOnlyHavePassword.getBytes(StandardCharsets.UTF_8));
     Assertions.assertEquals(
         AuthConstants.ANONYMOUS_USER,
         simpleAuthenticator
-            .authenticateToken(
-                (AuthConstants.AUTHORIZATION_BASIC_HEADER + "xx").getBytes(StandardCharsets.UTF_8))
+            .authenticateToken(basicToken.getBytes(StandardCharsets.UTF_8))
             .getName());
     Assertions.assertEquals(
         "gravitino",