CDM session credential pass-through.
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 35/100
- Issue 类型
- 文档
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 技术栈
- java, postgres
调研方向
从 CDM Configuration wiki 页面和链接行中的 DataSourceDTOParser.java 开始，然后跟踪 CDM 数据源的凭据是如何选择的。确认是传递会话凭据，还是使用服务账户凭据，并为用户清楚地记录结论和任何限制。
由索引模型根据 Issue 内容生成。
描述
Expected behavior
Not a bug - looking for clarification on the documentation and code.
Ideally, one might hope that the session credentials provided by the available identity providers (kerberos, openid, etc.) would be passed along to the CDM data sources to enforce access control at that layer. Furthermore, some users may infer that this level of security exists (possibly incorrectly) after going through the workflow they are familiar with for logging in to their identify provider / domain.
Actual behavior
As far as I can tell from reading the documents and the code, those tokens are only used (via the Shiro framework) to control access to the operational/postgres DB. Credentials for the CDM seem to be handled on a source by source basis, but generally the pattern seems to be using an application service account without passing through any session credentials.
To avoid confusion, it's clear that there are strong RBAC for webapi resources (in postgres/etc.) using the Shiro framework, and in a way this delegates the permissions of the CDM service account. This question is NOT about how session credential are passed from the client to the webapi. Instead, I am looking for clarification on which credentials are passed from the webapi to the CDM.
Question
Does the webapi make an effort to "pass-through" session credentials to the CDM data source in any way, or is the above description accurate?
For example, after going through an oauth flow, a user might expect that this is happening, but it is not clear if that is the case.
- 主要语言
- Java
- 星标
- 153
- 派生
- 187
- 平均合并
- 2 天 12 小时
- 30 天内合并 PR
- 13
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
OHDSI/WebAPI 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复
-
CDM cache warming still fails when cache.achilles.usePersonCount=false (missing `cc` alias in getBatchConceptRecordCount.sql)可能已有人在做 @DG47 于 3 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 67/100
维护者通常 1 天内回复
相似的 Issue
-
status: needs-triage
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 86/100
hiero-ledger/hiero-sdk-java#3010 ·
维护者通常 1 天内回复
-
Optimize consumer version heatmap aggregation to avoid repeated scans可能已有人在做 @praykaria31 今天认领。 未关闭type/enhancement
难度 2/5 1-3 小时 新手友好度 72/100
Apicurio/apicurio-registry#10662 · 1 条评论 ·
维护者通常 1 天内回复
-
a:false-positive
难度 2/5 1-3 小时 新手友好度 77/100
维护者通常 1 天内回复
-
status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 74/100
spring-projects/spring-boot#52347 ·
维护者通常 2 天内回复