Skip to content

Add support for mTLS authentication in Arrow Flight client #25179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add support for mTLS authentication in Arrow Flight client #25179

wants to merge 1 commit into from

Conversation

elbinpallimalilibm
Copy link
Contributor

Description

Add support for mTLS authentication in Arrow Flight client

Motivation and Context

If the Flight server has mTLS authentication enabled, then the Flight client should be able to use client certificate and key.

Impact

Test Plan

Added positive and negative test cases against an mTLS enabled Flight server.

Contributor checklist

  • Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Arrow Flight Connector Template Changes
* Added support for mTLS authentication in Arrow Flight client.

@prestodb-ci prestodb-ci added the from:IBM PR from IBM label May 23, 2025
@prestodb-ci prestodb-ci requested review from a team, bibith4 and pratyakshsharma and removed request for a team May 23, 2025 02:50
@elbinpallimalilibm elbinpallimalilibm marked this pull request as draft May 23, 2025 02:58
@elbinpallimalilibm
Copy link
Contributor Author

elbinpallimalilibm commented May 23, 2025 •
edited
Loading

https://github.com/prestodb/presto/actions/runs/15201290385/job/42755765576?pr=25179 @steveburnett I'm not able to figure out why the presto-docs check is failing. Can you help here?

Edit : Waiting for fix to be merged here.

@steveburnett
Copy link
Contributor

Fix has been merged, and the test is now passing - see #25188 for an example. Rebase your PR to re-run the CI tests and docs / test (:presto-docs) (pull_request) should pass for this PR as well.

@elbinpallimalilibm elbinpallimalilibm force-pushed the arrow_mtls branch 2 times, most recently from 7bdfc96 to bb2cf1d Compare May 24, 2025 00:10
@elbinpallimalilibm elbinpallimalilibm marked this pull request as ready for review May 24, 2025 02:28
@prestodb-ci prestodb-ci requested a review from a team May 24, 2025 02:28
pratyakshsharma
pratyakshsharma requested changes May 27, 2025
View reviewed changes
Copy link
Contributor

@pratyakshsharma pratyakshsharma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the fix @elbinpallimalilibm. I have added few comments, please check.

presto-base-arrow-flight/src/main/java/com/facebook/plugin/arrow/ArrowFlightConfig.java
return flightClientSSLCertificate;
}

@Config("arrow-flight.client-ssl-certificate")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it will be good to add a comment here saying this is needed for mTLS auth.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added comments.

...-base-arrow-flight/src/main/java/com/facebook/plugin/arrow/BaseArrowFlightClientHandler.java
Optional<InputStream> clientCertificate = Optional.empty();
Optional<InputStream> clientKey = Optional.empty();
if (config.getFlightClientSSLCertificate() != null && config.getFlightClientSSLKey() != null) {
clientCertificate = Optional.of(newInputStream(Paths.get(config.getFlightClientSSLCertificate())));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

trying to understand it a bit better, what happens if the certificate and key are invalid? Lets use a try-catch block here? And maybe add a test case covering this scenario?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the cert is invalid, executing a query will give the user an error that the cert is invalid. Added a test case that covers this scenario.

presto-docs/src/main/sphinx/connector/base-arrow-flight.rst Outdated
@@ -52,7 +52,9 @@ Property Name Description
========================================== ==============================================================
``arrow-flight.server`` Endpoint of the Flight server
``arrow-flight.server.port`` Flight server port
``arrow-flight.server-ssl-certificate`` Pass ssl certificate
``arrow-flight.server-ssl-certificate`` Path to SSL certificate of Flight server
``arrow-flight.client-ssl-certificate`` Path to SSL certificate that Flight client should use
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: lets modify these to include "in case of mTLS authentication" to make it more clear?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the docs.

presto-base-arrow-flight/src/test/java/com/facebook/plugin/arrow/TestArrowFlightMTLSFails.java Outdated
}

@BeforeClass
public void setup()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 2 test classes have a lot of duplicate code. Please see if we can use inheritance to avoid this redundant code?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Refactored the test classes.

@elbinpallimalilibm elbinpallimalilibm force-pushed the arrow_mtls branch 2 times, most recently from 117c43a to 4a84c3b Compare May 27, 2025 11:55
steveburnett
steveburnett approved these changes May 27, 2025
View reviewed changes
Copy link
Contributor

@steveburnett steveburnett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! (docs)

Pull branch, local doc build, looks good. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@steveburnett steveburnett steveburnett approved these changes

@elharo elharo Awaiting requested review from elharo elharo is a code owner

@hantangwangd hantangwangd Awaiting requested review from hantangwangd hantangwangd is a code owner automatically assigned from prestodb/committers

@bibith4 bibith4 Awaiting requested review from bibith4 bibith4 was automatically assigned from prestodb/ibm-reviewers

@pratyakshsharma pratyakshsharma Awaiting requested review from pratyakshsharma

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
from:IBM PR from IBM
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@elbinpallimalilibm @steveburnett @pratyakshsharma @prestodb-ci