Skip to content

Commit 96b74b8

Browse files
harshachharshach
authored
Merge branch 'main' into fmcardoso/add-permissioned-read-only-sparql-execution-for
2 parents fdd36b0 + 42d1535 commit 96b74b8

119 files changed

Lines changed: 9674 additions & 449 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/integration-tests-mysql-elasticsearch.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ jobs:
118118
- name: Checkout
119119
uses: actions/checkout@v7
120120
with:
121-
ref: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
121+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
122122
allow-unsafe-pr-checkout: true
123123
persist-credentials: false
124124
- name: Cache Maven dependencies
@@ -138,7 +138,7 @@ jobs:
138138
- name: Build and Bundle Integration Test Runtime
139139
env:
140140
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
141-
SOURCE_SHA: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
141+
SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
142142
run: |
143143
project_version="$(mvn --quiet --non-recursive help:evaluate \
144144
-Dexpression=project.version -DforceStdout -Dstyle.color=never)"
@@ -240,7 +240,7 @@ jobs:
240240
- name: Checkout
241241
uses: actions/checkout@v7
242242
with:
243-
ref: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
243+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
244244
allow-unsafe-pr-checkout: true
245245
persist-credentials: false
246246
- name: Cache Maven dependencies

‎.github/workflows/integration-tests-postgres-elasticsearch-redis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ jobs:
135135
- name: Checkout
136136
uses: actions/checkout@v7
137137
with:
138-
ref: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
138+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
139139
allow-unsafe-pr-checkout: true
140140
persist-credentials: false
141141
- name: Cache Maven dependencies
@@ -155,7 +155,7 @@ jobs:
155155
- name: Build and Bundle Integration Test Runtime
156156
env:
157157
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
158-
SOURCE_SHA: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
158+
SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
159159
run: |
160160
project_version="$(mvn --quiet --non-recursive help:evaluate \
161161
-Dexpression=project.version -DforceStdout -Dstyle.color=never)"
@@ -257,7 +257,7 @@ jobs:
257257
- name: Checkout
258258
uses: actions/checkout@v7
259259
with:
260-
ref: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
260+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
261261
allow-unsafe-pr-checkout: true
262262
persist-credentials: false
263263
- name: Cache Maven dependencies

‎.github/workflows/integration-tests-postgres-opensearch.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ jobs:
118118
- name: Checkout
119119
uses: actions/checkout@v7
120120
with:
121-
ref: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
121+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
122122
allow-unsafe-pr-checkout: true
123123
persist-credentials: false
124124
- name: Cache Maven dependencies
@@ -138,7 +138,7 @@ jobs:
138138
- name: Build and Bundle Integration Test Runtime
139139
env:
140140
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
141-
SOURCE_SHA: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
141+
SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
142142
run: |
143143
project_version="$(mvn --quiet --non-recursive help:evaluate \
144144
-Dexpression=project.version -DforceStdout -Dstyle.color=never)"
@@ -240,7 +240,7 @@ jobs:
240240
- name: Checkout
241241
uses: actions/checkout@v7
242242
with:
243-
ref: ${{ github.event_name == 'merge_group' && github.sha || github.event.pull_request.head.sha }}
243+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
244244
allow-unsafe-pr-checkout: true
245245
persist-credentials: false
246246
- name: Cache Maven dependencies

‎bootstrap/sql/migrations/native/2.1.0/mysql/postDataMigrationSQLScript.sql‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -235,3 +235,10 @@ WHERE name IN (
235235
COALESCE(JSON_EXTRACT(json, '$.parameterDefinition[*].name'), JSON_ARRAY()),
236236
'"dimensionFailurePolicy"'
237237
);
238+
239+
-- Normalize user emails to lowercase: email is the primary identity lookup key and the
240+
-- application always compares lowercased values. The case-insensitive unique key on email
241+
-- guarantees no collisions can result from lowercasing.
242+
UPDATE user_entity
243+
SET json = JSON_SET(json, '$.email', LOWER(JSON_UNQUOTE(JSON_EXTRACT(json, '$.email'))))
244+
WHERE BINARY JSON_UNQUOTE(JSON_EXTRACT(json, '$.email')) <> LOWER(JSON_UNQUOTE(JSON_EXTRACT(json, '$.email')));

‎bootstrap/sql/migrations/native/2.1.0/postgres/postDataMigrationSQLScript.sql‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,3 +213,11 @@ WHERE name IN (
213213
'columnValuesToBeUnique', 'columnValuesToMatchRegex', 'columnValuesToNotMatchRegex'
214214
)
215215
AND NOT ((json->'parameterDefinition')::jsonb @> '[{"name": "dimensionFailurePolicy"}]'::jsonb);
216+
217+
-- Normalize user emails to lowercase: email is the primary identity lookup key and the
218+
-- application always compares lowercased values. No collision guard is needed -- the 1.5.0
219+
-- migration already deleted rows duplicated by LOWER(email) and lowercased the survivors, and
220+
-- every write since normalizes, so at most one row can hold any given lowercased address.
221+
UPDATE user_entity
222+
SET json = jsonb_set(json, '{email}', to_jsonb(lower(json ->> 'email')))
223+
WHERE json ->> 'email' <> lower(json ->> 'email');

‎bootstrap/sql/migrations/native/2.1.0/postgres/schemaChanges.sql‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -324,3 +324,11 @@ CREATE INDEX IF NOT EXISTS idx_audit_log_entity_type_ts
324324
-- test connection, query runner and reverse ingestion runs.
325325
CREATE INDEX IF NOT EXISTS idx_automations_workflow_updated_at
326326
ON automations_workflow (updatedat);
327+
328+
-- Email-first identity: email/name lookups on the authentication hot path compare LOWER()
329+
-- values. Postgres columns are case-sensitive, so functional indexes are required to avoid a
330+
-- full table scan per login. Uniqueness is not restated here: user_entity already has UNIQUE
331+
-- constraints on email and name, and every write normalizes to lowercase, so the plain
332+
-- constraints already bound each lowercased value to one row.
333+
CREATE INDEX IF NOT EXISTS idx_user_entity_email_lower ON user_entity (LOWER(email));
334+
CREATE INDEX IF NOT EXISTS idx_user_entity_name_lower ON user_entity (LOWER(name));

‎conf/openmetadata.yaml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -433,10 +433,19 @@ migrationConfiguration:
433433
authorizerConfiguration:
434434
className: ${AUTHORIZER_CLASS_NAME:-org.openmetadata.service.security.DefaultAuthorizer}
435435
containerRequestFilter: ${AUTHORIZER_REQUEST_FILTER:-org.openmetadata.service.security.JwtFilter}
436+
437+
# Email-first admin configuration (recommended)
438+
adminEmails: ${AUTHORIZER_ADMIN_EMAILS:-[]}
439+
allowedEmailDomains: ${AUTHORIZER_ALLOWED_EMAIL_DOMAINS:-[]}
440+
botDomain: ${AUTHORIZER_BOT_DOMAIN:-""}
441+
442+
# Deprecated - use adminEmails instead
436443
adminPrincipals: ${AUTHORIZER_ADMIN_PRINCIPALS:-[admin]}
444+
# Deprecated - use botDomain for bots, allowedEmailDomains for user restrictions
445+
principalDomain: ${AUTHORIZER_PRINCIPAL_DOMAIN:-"open-metadata.org"}
446+
437447
# For MCP OAuth: Set to specific domains like ["company.com"] to restrict self-signup
438448
allowedEmailRegistrationDomains: ${AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN:-["all"]}
439-
principalDomain: ${AUTHORIZER_PRINCIPAL_DOMAIN:-"open-metadata.org"}
440449
allowedDomains: ${AUTHORIZER_ALLOWED_DOMAINS:-[]}
441450
enforcePrincipalDomain: ${AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN:-false}
442451
enableSecureSocketConnection : ${AUTHORIZER_ENABLE_SECURE_SOCKET:-false}
@@ -464,7 +473,16 @@ authenticationConfiguration:
464473
# Each entry must exactly match the requested redirect URI. Use for browser-extension logins,
465474
# e.g. ["https://<extension-id>.chromiumapp.org/auth0"].
466475
additionalTrustedRedirectUris: ${AUTHENTICATION_ADDITIONAL_TRUSTED_REDIRECT_URIS:-[]}
476+
477+
# Email-first claim configuration (recommended)
478+
# Set these to opt in to email-first identity resolution.
479+
# When unset, OpenMetadata continues using legacy jwtPrincipalClaims behavior.
480+
emailClaim: ${AUTHENTICATION_EMAIL_CLAIM:-""}
481+
displayNameClaim: ${AUTHENTICATION_DISPLAY_NAME_CLAIM:-""}
482+
483+
# Deprecated - use emailClaim instead
467484
jwtPrincipalClaims: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}
485+
# Deprecated - use emailClaim and displayNameClaim instead
468486
jwtPrincipalClaimsMapping: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING:-[]}
469487
enableSelfSignup : ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}
470488
enableAutoRedirect: ${AUTHENTICATION_ENABLE_AUTO_REDIRECT:-false}

0 commit comments

Comments
 (0)