Skip to content

[tests] Keep cluster tests that create users and roles on one server #3239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ccoltx wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

[tests] Keep cluster tests that create users and roles on one server #3239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions client-v2/src/test/java/com/clickhouse/client/ClientTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
import com.clickhouse.client.api.ServerException;
import com.clickhouse.client.api.command.CommandSettings;
import com.clickhouse.client.api.enums.Protocol;
import com.clickhouse.client.api.http.ClickHouseHttpProto;
import com.clickhouse.client.api.insert.InsertSettings;
import com.clickhouse.client.api.internal.CompressedBlockOutputStream;
import com.clickhouse.client.api.internal.CredentialsManager;
Expand Down Expand Up @@ -441,15 +442,15 @@ public void testOperationCustomRoles(String[] roles) throws Exception {

String password = "^1A" + RandomStringUtils.random(12, true, true) + "3b$";
final String rolesList = "\"" + Strings.join("\",\"", roles) + "\"";
try (Client client = newClient().build()) {
try (Client client = newClientOnSameServer().build()) {
client.execute("DROP ROLE IF EXISTS " + rolesList).get().close();
client.execute("CREATE ROLE " + rolesList).get().close();
client.execute("DROP USER IF EXISTS some_user").get().close();
client.execute("CREATE USER some_user IDENTIFIED BY '" + password + "'").get().close();
client.execute("GRANT " + rolesList + " TO some_user").get().close();
}

try (Client userClient = newClient().setUsername("some_user").setPassword(password).build()) {
try (Client userClient = newClientOnSameServer().setUsername("some_user").setPassword(password).build()) {
QuerySettings settings = new QuerySettings().setDBRoles(Arrays.asList(roles));
List<GenericRecord> resp = userClient.queryAll("SELECT currentRoles()", settings);
Set<String> roleSet = new HashSet<>(Arrays.asList(roles));
Expand All @@ -473,15 +474,15 @@ public void testClientCustomRoles(String[] roles) throws Exception {

String password = "^1A" + RandomStringUtils.insecure().next(12, true, true) + "3B$";
final String rolesList = "\"" + Strings.join("\",\"", roles) + "\"";
try (Client client = newClient().build()) {
try (Client client = newClientOnSameServer().build()) {
client.execute("DROP ROLE IF EXISTS " + rolesList).get().close();
client.execute("CREATE ROLE " + rolesList).get().close();
client.execute("DROP USER IF EXISTS some_user").get().close();
client.execute("CREATE USER some_user IDENTIFIED WITH sha256_password BY '" + password + "'").get().close();
client.execute("GRANT " + rolesList + " TO some_user").get().close();
}

try (Client userClient = newClient().setUsername("some_user").setPassword(password).build()) {
try (Client userClient = newClientOnSameServer().setUsername("some_user").setPassword(password).build()) {
userClient.setDBRoles(Arrays.asList(roles));
List<GenericRecord> resp = userClient.queryAll("SELECT currentRoles()");
Set<String> roleSet = new HashSet<>(Arrays.asList(roles));
Expand Down Expand Up @@ -901,4 +902,13 @@ protected Client.Builder newClient() {
.setPassword(ClickHouseServerForTest.getPassword())
.setDefaultDatabase(ClickHouseServerForTest.getDatabase());
}

/**
* Sends every request to the same server of a cluster or ClickHouse Cloud. The other servers learn
* about a new user or role a moment later, so a test that creates one and then connects as it
* stays on one server.
*/
private Client.Builder newClientOnSameServer() {
return newClient().httpHeader(ClickHouseHttpProto.HEADER_REPLICA_TAG, "client_tests_access");

@chernser chernser Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pinning replica makes this tests effectively same as we run for single node. Then it should be skipped for cloud and cluster or another solution should be applied.
And we cannot skip this tests because they verify important feature.

@ccoltx ccoltx Oct 21, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point.

I can only assume this is a timing issue. The tests create users and roles and it needs to wait a few seconds for that information to be propagated throughout the cluster.

Shall we add some retries to the tests themselves?

@chernser chernser Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can but I would start with talking to Cloud Team about this issues.
For that we need to fetch query_log for tests and understand in what time queries landed on different replicas.

}
}
12 changes: 12 additions & 0 deletions client-v2/src/test/java/com/clickhouse/client/HttpTransportTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1071,6 +1071,13 @@ public void testSSLAuthentication() throws Exception {
}
}

/**
* Tag for {@link ClickHouseHttpProto#HEADER_REPLICA_TAG} that sends every request to the same server of a
* cluster. The other servers learn about a new user a moment later, so a test that creates one and
* then connects as it stays on one server.
*/
private static final String SAME_SERVER_TAG = "http_transport_tests_access";

@Test(groups = { "integration" }, dataProvider = "testPasswordAuthenticationProvider", dataProviderClass = HttpTransportTests.class)
public void testPasswordAuthentication(String identifyWith, String identifyBy, boolean failsWithHeaders) throws Exception {
if (isCloud()) {
Expand All @@ -1079,6 +1086,7 @@ public void testPasswordAuthentication(String identifyWith, String identifyBy, b
ClickHouseNode server = getServer(ClickHouseProtocol.HTTP);

try (Client client = new Client.Builder().addEndpoint(Protocol.HTTP, "localhost",server.getPort(), false)
.httpHeader(ClickHouseHttpProto.HEADER_REPLICA_TAG, SAME_SERVER_TAG)
.setUsername("dba")
.setPassword("dba")
.build()) {
Expand All @@ -1093,6 +1101,7 @@ public void testPasswordAuthentication(String identifyWith, String identifyBy, b


try (Client client = new Client.Builder().addEndpoint(Protocol.HTTP, "localhost",server.getPort(), false)
.httpHeader(ClickHouseHttpProto.HEADER_REPLICA_TAG, SAME_SERVER_TAG)
.setUsername("some_user")
.setPassword(identifyBy)
.build()) {
Expand All @@ -1104,6 +1113,7 @@ public void testPasswordAuthentication(String identifyWith, String identifyBy, b

if (failsWithHeaders) {
try (Client client = new Client.Builder().addEndpoint(Protocol.HTTP, "localhost",server.getPort(), false)
.httpHeader(ClickHouseHttpProto.HEADER_REPLICA_TAG, SAME_SERVER_TAG)
.setUsername("some_user")
.setPassword(identifyBy)
.useHTTPBasicAuth(false)
Expand Down Expand Up @@ -1142,6 +1152,7 @@ public void testAuthHeaderIsKeptFromUser() throws Exception {
String identifyWith = "sha256_password";
String identifyBy = "123搂";
try (Client client = new Client.Builder().addEndpoint(Protocol.HTTP, "localhost",server.getPort(), false)
.httpHeader(ClickHouseHttpProto.HEADER_REPLICA_TAG, SAME_SERVER_TAG)
.setUsername("dba")
.setPassword("dba")
.build()) {
Expand All @@ -1156,6 +1167,7 @@ public void testAuthHeaderIsKeptFromUser() throws Exception {


try (Client client = new Client.Builder().addEndpoint(Protocol.HTTP, "localhost",server.getPort(), false)
.httpHeader(ClickHouseHttpProto.HEADER_REPLICA_TAG, SAME_SERVER_TAG)
.setUsername("some_user")
.setPassword(identifyBy)
.useHTTPBasicAuth(false) // disable basic auth to produce CH headers
Expand Down
Loading