search

open-metadata / OpenMetadata

OpenMetadata is a unified metadata platform for data discovery, data observability, and data governance powered by a central metadata repository, in-depth column level lineage, and seamless team collaboration.
https://open-metadata.org
Apache License 2.0
5.26k stars 994 forks source link

Openmetadata Basic Authentication does not allow to set the admin passwords since PR11463 #16662

Open przemslys opened 3 months ago

przemslys commented 3 months ago

Affected module openmetadata-service UI

Describe the bug According to the documentation it is possible to setup a set of users and their passwords as a comma separated list as adminPrincipals in authorizerConfiguration (a note within https://docs.open-metadata.org/v1.4.x/deployment/security/basic-auth#authorizer-configuration claims that), however, instead of splitting the provided string by colon to get (admin_user_name, admin_user_password) pairs the entire string as passed as admin user name, with colon being the part of it. After digging in the source code I'm pretty confident the culprit is one of the PR introduced last year, namely https://github.com/open-metadata/OpenMetadata/pull/11463/files when any mention of COLON_DELIMITER within UserUtil class was removed.

To Reproduce The problem was noticed whie working on local minikube, so I'll provide the steps starting with the chart information, even if this error is not related to helm chart: 1) please use the helm chart below to deploy OMD on local minikube, please only build the helm chart by running 'kustomize build --enable-helm > .\your_manifests.yaml' `helmChartInflationGenerator:

Expected behavior The expectation was that the users would be created with the passwords specified in the config.

Version:

Additional context

harshach commented 3 months ago

cc @akash-jain-10 @mohityadav766

harshach commented 3 months ago

@przemslys any reason you want to control this via config rather use the defautl admin/admin to reset the password through the UI?

przemslys commented 3 months ago

hi @harshach there are few reasons:

  1. the documentation says I can set those passwords up in the envvar and I cannot find any release notes claiming this feature was intentionally removed;
  2. working on k8s means that the Pods (think of them as of a brand new VMs with Openmetadata that do not have persitant memory between restarts) are constantly and randomly restarted, rendering any changes "clicked out" by the Openmetadata admin useless.
  3. the currently running approach reqiures a close cooperation between DevOps that deploys the OMD and the admin of OMD, who must act quickily to change the password manually before other users figure the passwords out...
  4. if the OMD worked as described in the documentation, we could store the contents of the envvar (so a list of pairs of admin user name and their passwords) as a k8s secret, allowing for a precise and secure way of passing the admin credentials from DevOps to OMD admin; Instead, everyone (all parties involved including DevOps, people that are supposed to work as OMD admins and simple users, even readers of this publicly hosted discussion) knows the admin password - I do not like that...

I mean we eventually will find some workaround for this bug but if the removal of the functionality was indeed done on purpose, please adjust the documentation so in the future such problems would be avoided. If it was removed accidently I humbly ask for the reimplementation of the functionality.

Kind Regards