Remove OpenIdAuthorizer and OpenID authentication dependencies (#17320)

* Remove OpenID authorizer and configuration dependencies

* Remove stale OpenID dependencies from SBOM metadata

Author: HTHou

LICENSE-binary

@@ -216,28 +216,21 @@ following license. See licenses/ for text of these licenses.
 Apache License 2.0
 --------------------------------------
 commons-cli:commons-cli:1.5.0
-com.nimbusds:content-type:2.2
 com.google.code.gson:gson:2.13.1
 com.google.guava.guava:32.1.2-jre
 com.fasterxml.jackson.core:jackson-annotations:2.16.2
 com.fasterxml.jackson.core:jackson-core:2.16.2
 com.fasterxml.jackson.core:jackson-databind:2.16.2
 jakarta.inject:jakarta.inject:2.6.1
 at.yawk.lz4:lz4-java:1.10.0
-com.github.stephenc.jcip:jcip-annotations:1.0-1
 com.github.ben-manes.caffeine:caffeine:2.9.3
 org.eclipse.jetty:jetty-http:9.4.58.v20250814
 org.eclipse.jetty:jetty-io:9.4.58.v20250814
 org.eclipse.jetty:jetty-security:9.4.58.v20250814
 org.eclipse.jetty:jetty-server:9.4.58.v20250814
 org.eclipse.jetty:jetty-servlet:9.4.58.v20250814
 org.eclipse.jetty:jetty-util:9.4.58.v20250814
-io.jsonwebtoken:jjwt-api:0.12.7
-io.jsonwebtoken:jjwt-impl:0.12.7
-io.jsonwebtoken:jjwt-jackson:0.12.7
-net.minidev:json-smart:2.5.2
 com.google.code.findbugs:jsr305:3.0.2
-com.nimbusds:lang-tag:1.7
 com.librato.metrics:librato-java:2.1.0
 org.apache.thrift:libthrift:0.14.1
 io.dropwizard.metrics:metrics-core:4.2.19
@@ -255,14 +248,11 @@ io.netty:netty-transport:4.1.126.Final
 io.netty:netty-transport-native-epoll:4.1.126.Final:linux-aarch_64
 io.netty:netty-transport-native-epoll:4.1.126.Final:linux-x86_64
 io.netty:netty-transport-native-unix-common:4.1.126.Final
-com.nimbusds:nimbus-jose-jwt:9.37.4
-com.nimbusds:oauth2-oidc-sdk:10.15
 org.osgi:org.osgi.core:7.0.0
 org.osgi:osgi.cmpn:7.0.0
 org.ops4j.pax.jdbc:pax-jdbc-common:1.5.6
 org.xerial.snappy:snappy-java:1.1.10.5
 io.airlift.airline:0.9
-net.minidev:accessors-smart:2.5.0
 
 
 BSD 3-Clause

dependencies.json

@@ -18,7 +18,6 @@
     "com.github.ben-manes.caffeine:caffeine",
     "com.github.luben:zstd-jni",
     "com.github.moquette-io.moquette:moquette-broker",
-    "com.github.stephenc.jcip:jcip-annotations",
     "com.github.wendykierp:JTransforms",
     "com.google.code.findbugs:jsr305",
     "com.google.code.gson:gson",
@@ -28,10 +27,6 @@
     "com.google.guava:listenablefuture",
     "com.google.j2objc:j2objc-annotations",
     "com.h2database:h2-mvstore",
-    "com.nimbusds:content-type",
-    "com.nimbusds:lang-tag",
-    "com.nimbusds:nimbus-jose-jwt",
-    "com.nimbusds:oauth2-oidc-sdk",
     "com.sun.istack:istack-commons-runtime",
     "com.zaxxer:HikariCP",
     "commons-cli:commons-cli",
@@ -40,7 +35,6 @@
     "io.airlift:airline",
     "io.airlift:units",
     "io.dropwizard.metrics:metrics-core",
-    "io.jsonwebtoken:jjwt-api",
     "io.micrometer:micrometer-commons",
     "io.micrometer:micrometer-core",
     "io.micrometer:micrometer-observation",
@@ -88,8 +82,6 @@
     "javax.xml.bind:jaxb-api",
     "net.java.dev.jna:jna",
     "net.java.dev.jna:jna-platform",
-    "net.minidev:accessors-smart",
-    "net.minidev:json-smart",
     "org.antlr:antlr4-runtime",
     "org.apache.commons:commons-csv",
     "org.apache.commons:commons-lang3",

iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/auth/AuthorPlanExecutor.java

@@ -22,7 +22,6 @@
 import org.apache.iotdb.common.rpc.thrift.TSStatus;
 import org.apache.iotdb.commons.auth.AuthException;
 import org.apache.iotdb.commons.auth.authorizer.IAuthorizer;
-import org.apache.iotdb.commons.auth.authorizer.OpenIdAuthorizer;
 import org.apache.iotdb.commons.auth.entity.ModelType;
 import org.apache.iotdb.commons.auth.entity.PrivilegeModelType;
 import org.apache.iotdb.commons.auth.entity.PrivilegeType;
@@ -83,14 +82,7 @@ public TPermissionInfoResp login(
     try {
       status = authorizer.login(username, password, useEncryptedPassword);
       if (status) {
-        // Bring this user's permission information back to the datanode for caching
-        if (authorizer instanceof OpenIdAuthorizer) {
-          username = ((OpenIdAuthorizer) authorizer).getIoTDBUserName(username);
-          result = getUserPermissionInfo(username, ModelType.ALL);
-          result.getUserInfo().setIsOpenIdUser(true);
-        } else {
-          result = getUserPermissionInfo(username, ModelType.ALL);
-        }
+        result = getUserPermissionInfo(username, ModelType.ALL);
 
         result.setStatus(RpcUtils.getStatus(TSStatusCode.SUCCESS_STATUS, "Login successfully"));
       } else {

iotdb-core/datanode/pom.xml

@@ -282,33 +282,11 @@
             <artifactId>mockito-core</artifactId>
             <scope>test</scope>
         </dependency>
-        <!-- Possibly these need to move into the compile or provided scope -->
-        <dependency>
-            <groupId>io.jsonwebtoken</groupId>
-            <artifactId>jjwt-impl</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <!-- Possibly these need to move into the compile or provided scope -->
-        <dependency>
-            <groupId>io.jsonwebtoken</groupId>
-            <artifactId>jjwt-jackson</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>net.minidev</groupId>
-            <artifactId>json-smart</artifactId>
-            <scope>test</scope>
-        </dependency>
         <dependency>
             <groupId>org.apache.ratis</groupId>
             <artifactId>ratis-thirdparty-misc</artifactId>
             <scope>runtime</scope>
         </dependency>
-        <dependency>
-            <groupId>com.nimbusds</groupId>
-            <artifactId>oauth2-oidc-sdk</artifactId>
-            <scope>test</scope>
-        </dependency>
         <dependency>
             <groupId>org.powermock</groupId>
             <artifactId>powermock-core</artifactId>
@@ -493,11 +471,6 @@
                         <!-- For some reason this plugin missed it being used for a constant import -->
                         <ignoredDependency>org.apache.iotdb:isession</ignoredDependency>
                     </ignoredDependencies>
-                    <usedDependencies>
-                        <!-- These are used at runtime in tests -->
-                        <usedDependency>io.jsonwebtoken:jjwt-impl</usedDependency>
-                        <usedDependency>io.jsonwebtoken:jjwt-jackson</usedDependency>
-                    </usedDependencies>
                 </configuration>
             </plugin>
             <plugin>

iotdb-core/datanode/src/test/java/org/apache/iotdb/db/auth/authorizer/OpenIdAuthorizerTest.java

@@ -138,26 +138,10 @@
             <groupId>com.google.code.findbugs</groupId>
             <artifactId>jsr305</artifactId>
         </dependency>
-        <dependency>
-            <groupId>net.minidev</groupId>
-            <artifactId>json-smart</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.nimbusds</groupId>
-            <artifactId>nimbus-jose-jwt</artifactId>
-        </dependency>
         <dependency>
             <groupId>cglib</groupId>
             <artifactId>cglib</artifactId>
         </dependency>
-        <dependency>
-            <groupId>io.jsonwebtoken</groupId>
-            <artifactId>jjwt-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.nimbusds</groupId>
-            <artifactId>oauth2-oidc-sdk</artifactId>
-        </dependency>
         <dependency>
             <groupId>com.github.ben-manes.caffeine</groupId>
             <artifactId>caffeine</artifactId>

iotdb-core/node-commons/pom.xml

@@ -1733,16 +1733,10 @@ compressor=LZ4
 ####################
 
 # which class to serve for authorization. By default, it is LocalFileAuthorizer.
-# Another choice is org.apache.iotdb.commons.auth.authorizer.OpenIdAuthorizer
 # effectiveMode: restart
 # Privilege: SECURITY
 authorizer_provider_class=org.apache.iotdb.commons.auth.authorizer.LocalFileAuthorizer
 
-# If OpenIdAuthorizer is enabled, then openID_url must be set.
-# effectiveMode: restart
-# Privilege: SECURITY
-openID_url=
-
 # encryption provider class
 # effectiveMode: first_start
 iotdb_server_encrypt_decrypt_provider=org.apache.iotdb.commons.security.encrypt.MessageDigestEncrypt