Page History

...

Http Interface Authentication

1. When BE performs authentication, because it does not store metadata information, FE needs to provide the corresponding authentication interfaceWithout metadata information stored in BE, it is necessary to perform an interactive authentication with FE, which is implemented through RPC calls as follows:

   
   

   THttpAuthRequest {     1: optional string cluster     2: required string user     3: required string passwd     4: optional string user_ip     5: optional string glb     6: optional string db     7: optional string tbl     8: optional string col     9: optional string res     10: optional TPrivilegeType priv_type     11: optional i64 thrift_rpc_timeout_ms } THttpAuthResult {      1. reuired Status.TStatus status }

   
   

2. Each Interface requires different permissions, as follows：

   handler

   api

   interface

   whether performs authentication

   is required

   permissions required

   permissions 

   JeprofileActions	get	/jeheap/dump	no	none
   HeapAction	get	/pprof/heap
   GrowthAction	get	/pprof/growth
   ProfileAction	get	/pprof/profile
   PmuProfileAction	get	/pprof/pmuprofile
   ContentionAction	get	/pprof/contention
   CmdlineAction	get	/pprof/cmdline
   SymbolAction	get	/pprof/symbol
   	head	/pprof/symbol
   	put	/pprof/symbol
   StreamLoadAction	put	/api/{db}/{table}/_load	yes	LOAD
   	put	/api/{db}/{table}/_stream_load	yes	LOAD
   StreamLoad2PCAction	put	/api/{db}/_stream_load_2pc	yes	LOAD
   	put	/api/{db}/{table}/_stream_load_2pc	yes	LOAD
   DownloadAction	head	/api/_download_load	yes	USAGE
   	head	/api/_tablet/_download
   	head	/api/_load_error_log
   	get	/api/_download_load
   	get	/api/_tablet/_download
   	get	/api/_load_error_log
   VersionAction	get	/api/be_version_info	yes	NODE
   HealthAction	get	/api/health	yes	none
   TabletsInfoAction	get	/tablets_json	yes	NODE
   TabletsDistributionAction	get	/api/tablets_distribution	yes	NODE
   TabletMigrationAction	get	/api/tablet_migration	yes	NODE
   MetricsAction	get	/metrics	no	none
   MetaAction	get	/api/meta/header/{tablet_id}	yes	NODE
   ChecksumAction	get	/api/checksum	yes	NODE
   ReloadTabletAction	get	/api/reload_tablet	yes	NODE
   	post	/api/restore_tablet	yes	NODE
   SnapshotAction	get	/api/snapshot	yes	NODE
   CompactionAction	get	/api/compaction/show	yes	NODE
   	get	/api/compaction/run_status	yes	NODE
   	post	/api/compaction/run	yes	NODE
   ConfigAction	get	/api/show_config	yes	NODE
   	post	/api/update_config	yes	NODE
   CheckRPCChannelAction	get	/api/check_rpc_channel/{ip}/{port}/{payload_size}	yes	NODE
   ResetRPCChannelAction	get	/api/reset_rpc_channel/{endpoints}	yes	NODE
   CheckTabletSegmentAction	post	/api/check_tablet_segment_lost	yes	NODE
   PadRowsetAction	post	/api/pad_rowset	yes	NODE

   
   

Https Implementation

1. Generate an SSL Certificate

   In developmet environment, SSL certificates can be generated by openssl as follow:

   openssl genrsa -out private.pem 1024 openssl req -new -x509 -days 3650 -key private.pem -out cert.pem -subj "/CN=my.host.name"

   In production environment, SSL certificates need to be purchased from the CA.

2. Configure path of SSL Certificate in be.conf

   enable_https = true;  ssl_certificate_path = DORIS_HOME_DIR + "/conf/ssl/cert.pem"; ssl_private_key_path = DORIS_HOME_DIR + "/conf/ssl/private.pem";

   
   

3. Turn on SSL in brpc server

   Fill the sslOption with the path of certificate and private key before starting server.

   if (config::enable_https) { auto sslOptions = options.mutable_ssl_options();   sslOptions->default_cert.certificate = config::ssl_certificate_path;   sslOptions->default_cert.private_key = config::ssl_private_key_path; } _server->Start(port, &options);

   
   

4. Redirect http request to HTTPS

   In the brpc server, SSL-only mode can only be implemented using Controller::is_ssl() in callback of each service.

   if (config::ssl_only && !cntl->is_ssl())  {     cntl->http_response().set_status_code(baidu::rpc::HTTP_STATUS_FOUND);     cntl->http_response().SetHeader("Location", "https://xxx"); }

   A global configure for SSL-only mode may be better than the implementation described above, which would be supported by brpc in the future.

...