Tests/testdrive: platform-test password auth

DAlperin · DAlperin · commit 4c6b8e076e8d · 2025-09-29T11:33:56.000-04:00
This adds auth testdrive tests (and the ability for testdrive to test
auth).
diff --git a/misc/python/materialize/checks/all_checks/roles.py b/misc/python/materialize/checks/all_checks/roles.py
@@ -10,6 +10,8 @@
 
 from materialize.checks.actions import Testdrive
 from materialize.checks.checks import TESTDRIVE_NOP, Check
+from materialize.checks.executors import Executor
+from materialize.mz_version import MzVersion
 
 
 class CreateRole(Check):
@@ -107,3 +109,87 @@ def validate(self) -> Testdrive:
             """
             )
         )
+
+
+class PasswordAuthentication(Check):
+    def _can_run(self, e: Executor):
+        return self.base_version >= MzVersion.parse("v0.159.0-dev")
+
+    def initialize(self) -> Testdrive:
+        return Testdrive(
+            dedent(
+                """
+                # Create roles with passwords and LOGIN privilege
+                > CREATE ROLE auth_user1 WITH LOGIN PASSWORD 'password1'
+                > CREATE ROLE auth_user2 WITH LOGIN PASSWORD 'password2'
+                > CREATE ROLE auth_user_nopass WITH LOGIN
+
+                # Grant privileges
+                > GRANT CREATE ON DATABASE materialize TO auth_user1
+                > GRANT USAGE ON DATABASE materialize TO auth_user2
+                """
+            )
+        )
+
+    def manipulate(self) -> list[Testdrive]:
+        return [
+            Testdrive(
+                dedent(
+                    """
+                    # Test connection with correct password
+                    $ postgres-connect name=user1_conn url=postgres://auth_user1:password1@${testdrive.materialize-password-sql-addr}
+
+                    $ postgres-execute connection=user1_conn
+                    CREATE TABLE auth_test_table1 (id INT, data TEXT);
+                    INSERT INTO auth_test_table1 VALUES (1, 'test from user1');
+
+                    # Create another user with password and LOGIN
+                    > CREATE ROLE auth_user3 WITH LOGIN PASSWORD 'password3'
+                    > GRANT SELECT ON TABLE auth_test_table1 TO auth_user3
+                    """
+                )
+            ),
+            Testdrive(
+                dedent(
+                    """
+                    # Test connection with user2
+                    $ postgres-connect name=user2_conn url=postgres://auth_user2:password2@${testdrive.materialize-password-sql-addr}
+
+                    $ postgres-execute connection=user2_conn
+                    SELECT * FROM auth_test_table1;
+
+                    # Test connection with user3
+                    $ postgres-connect name=user3_conn url=postgres://auth_user3:password3@${testdrive.materialize-password-sql-addr}
+
+                    $ postgres-execute connection=user3_conn
+                    SELECT 1;
+
+                    # Test that user without password can connect to non-password port
+                    $ postgres-connect name=nopass_conn url=postgres://auth_user_nopass@${testdrive.materialize-sql-addr}
+
+                    $ postgres-execute connection=nopass_conn
+                    SELECT 1;
+                    """
+                )
+            ),
+        ]
+
+    def validate(self) -> Testdrive:
+        return Testdrive(
+            dedent(
+                """
+                # Validate all auth users exist
+                > SELECT name FROM mz_roles WHERE name LIKE 'auth_user%' ORDER BY name;
+                auth_user1
+                auth_user2
+                auth_user3
+                auth_user_nopass
+
+                # Test connection with user2
+                $ postgres-connect name=user2_conn url=postgres://auth_user2:password2@${testdrive.materialize-password-sql-addr}
+
+                > SELECT * FROM auth_test_table1 ORDER BY id;
+                1 "test from user1"
+                """
+            )
+        )
diff --git a/misc/python/materialize/checks/mzcompose_actions.py b/misc/python/materialize/checks/mzcompose_actions.py
@@ -70,6 +70,14 @@ def execute(self, e: Executor) -> None:
         image = f"materialize/materialized:{self.tag}" if self.tag is not None else None
         print(f"Starting Mz using image {image}, mz_service {self.mz_service}")
 
+        listeners_config_path = (
+            f"{MZ_ROOT}/src/materialized/ci/listener_configs/no_auth.json"
+        )
+        if self.tag and self.tag >= MzVersion.parse("v0.159.0-dev"):
+            listeners_config_path = (
+                f"{MZ_ROOT}/src/materialized/ci/listener_configs/mixed_auth.json"
+            )
+
         mz = Materialized(
             name=self.mz_service,
             image=image,
@@ -89,6 +97,7 @@ def execute(self, e: Executor) -> None:
             publish=self.publish,
             default_replication_factor=2,
             support_external_clusterd=True,
+            listeners_config_path=listeners_config_path,
         )
 
         # Don't fail since we are careful to explicitly kill and collect logs
diff --git a/misc/python/materialize/mzcompose/__init__.py b/misc/python/materialize/mzcompose/__init__.py
@@ -367,6 +367,15 @@ def get_variable_system_parameters(
         VariableSystemParameter(
             "sql_server_offset_known_interval", "1s", ["10ms", "100ms", "1s"]
         ),
+        VariableSystemParameter(
+            "enable_password_auth",
+            ("true" if version >= MzVersion.parse_mz("v0.142.0") else "false"),
+            (
+                ["true", "false"]
+                if version >= MzVersion.parse_mz("v0.142.0")
+                else ["false"]
+            ),
+        ),
         # End of list (ordered by name)
     ]
 
@@ -550,7 +559,6 @@ def get_default_system_parameters(
     "plan_insights_notice_fast_path_clusters_optimize_duration",
     "enable_continual_task_builtins",
     "enable_expression_cache",
-    "enable_password_auth",
     "mz_metrics_lgalloc_map_refresh_interval",
     "mz_metrics_lgalloc_refresh_interval",
     "mz_metrics_rusage_refresh_interval",
diff --git a/misc/python/materialize/mzcompose/services/materialized.py b/misc/python/materialize/mzcompose/services/materialized.py
@@ -43,7 +43,7 @@ def __init__(self, image: str | None = None):
 
         config: ServiceConfig = {
             "mzbuild": name,
-            "ports": [6875, 6876, 6877, 6878, 26257],
+            "ports": [6875, 6876, 6877, 6878, 6885, 6895, 26257],
             "healthcheck": {
                 "test": ["CMD", "curl", "-f", "localhost:6878/api/readyz"],
                 "interval": "1s",
@@ -342,7 +342,7 @@ def __init__(
             {
                 "depends_on": depends_graph,
                 "command": command,
-                "ports": [6875, 6876, 6877, 6878, 26257],
+                "ports": [6875, 6876, 6877, 6878, 6885, 6895, 26257],
                 "environment": environment,
                 "volumes": volumes,
                 "tmpfs": ["/tmp"],
diff --git a/misc/python/materialize/mzcompose/services/testdrive.py b/misc/python/materialize/mzcompose/services/testdrive.py
@@ -29,6 +29,8 @@ def __init__(
         mzbuild: str = "testdrive",
         materialize_url: str = "postgres://materialize@materialized:6875",
         materialize_url_internal: str = "postgres://materialize@materialized:6877",
+        materialize_password_sql_url: str | None = None,
+        materialize_sasl_sql_url: str | None = None,
         materialize_use_https: bool = False,
         materialize_params: dict[str, str] = {},
         kafka_url: str = "kafka:9092",
@@ -111,6 +113,16 @@ def __init__(
 
         entrypoint.append(f"--backoff-factor={backoff_factor}")
 
+        # Add the password-protected connection parameters
+        if materialize_password_sql_url:
+            entrypoint.append(
+                f"--materialize-password-sql-url={materialize_password_sql_url}"
+            )
+        if materialize_sasl_sql_url:
+            entrypoint.append(
+                f"--materialize-sasl-sql-url={materialize_sasl_sql_url}"
+            )
+
         if aws_region:
             entrypoint.append(f"--aws-region={aws_region}")
 
diff --git a/src/materialized/ci/listener_configs/mixed_auth.json b/src/materialized/ci/listener_configs/mixed_auth.json
@@ -0,0 +1,50 @@
+{
+  "sql": {
+    "external": {
+      "addr": "0.0.0.0:6875",
+      "authenticator_kind": "None",
+      "allowed_roles": "Normal",
+      "enable_tls": false
+    },
+    "external_password": {
+      "addr": "0.0.0.0:6885",
+      "authenticator_kind": "Password",
+      "allowed_roles": "Normal",
+      "enable_tls": false
+    },
+    "internal": {
+      "addr": "0.0.0.0:6877",
+      "authenticator_kind": "None",
+      "allowed_roles": "Internal",
+      "enable_tls": false
+    }
+  },
+  "http": {
+    "external": {
+      "addr": "0.0.0.0:6876",
+      "authenticator_kind": "None",
+      "allowed_roles": "NormalAndInternal",
+      "enable_tls": false,
+      "routes": {
+        "base": true,
+        "webhook": true,
+        "internal": false,
+        "metrics": false,
+        "profiling": false
+      }
+    },
+    "internal": {
+      "addr": "0.0.0.0:6878",
+      "authenticator_kind": "None",
+      "allowed_roles": "NormalAndInternal",
+      "enable_tls": false,
+      "routes": {
+        "base": true,
+        "webhook": true,
+        "internal": true,
+        "metrics": true,
+        "profiling": true
+      }
+    }
+  }
+}
diff --git a/src/testdrive/src/action.rs b/src/testdrive/src/action.rs
@@ -131,6 +131,10 @@ pub struct Config {
     /// The port for the internal endpoints of the materialize instance that
     /// testdrive will connect to via HTTP.
     pub materialize_internal_http_port: u16,
+    /// The connection string for the password-protected SQL endpoint.
+    pub materialize_password_sql_url: Option<tokio_postgres::Config>,
+    /// The connection string for the SASL-protected SQL endpoint.
+    pub materialize_sasl_sql_url: Option<tokio_postgres::Config>,
     /// Session parameters to set after connecting to materialize.
     pub materialize_params: Vec<(String, String)>,
     /// An optional catalog configuration.
@@ -191,6 +195,8 @@ pub struct MaterializeState {
     http_addr: String,
     internal_sql_addr: String,
     internal_http_addr: String,
+    password_sql_addr: Option<String>,
+    sasl_sql_addr: Option<String>,
     user: String,
     pgclient: tokio_postgres::Client,
     environment_id: EnvironmentId,
@@ -334,6 +340,19 @@ impl State {
             "testdrive.materialize-user".into(),
             self.materialize.user.clone(),
         );
+        // Add password-protected connection variables if they exist
+        if let Some(ref password_sql_addr) = self.materialize.password_sql_addr {
+            self.cmd_vars.insert(
+                "testdrive.materialize-password-sql-addr".into(),
+                password_sql_addr.clone(),
+            );
+        }
+        if let Some(ref sasl_sql_addr) = self.materialize.sasl_sql_addr {
+            self.cmd_vars.insert(
+                "testdrive.materialize-sasl-sql-addr".into(),
+                sasl_sql_addr.clone(),
+            );
+        }
         self.cmd_vars.insert(
             "testdrive.fivetran-destination-url".into(),
             self.fivetran_destination_url.clone(),
@@ -1130,6 +1149,26 @@ async fn create_materialize_state(
         materialize_internal_url.host_str().unwrap(),
         config.materialize_internal_http_port
     );
+    let materialize_password_sql_addr = if let Some(ref password_config) = config.materialize_password_sql_url {
+        let password_url = util::postgres::config_url(password_config)?;
+        Some(format!(
+            "{}:{}",
+            password_url.host_str().unwrap(),
+            password_url.port().unwrap()
+        ))
+    } else {
+        None
+    };
+    let materialize_sasl_sql_addr = if let Some(ref sasl_config) = config.materialize_sasl_sql_url {
+        let sasl_url = util::postgres::config_url(sasl_config)?;
+        Some(format!(
+            "{}:{}",
+            sasl_url.host_str().unwrap(),
+            sasl_url.port().unwrap()
+        ))
+    } else {
+        None
+    };
     let environment_id = pgclient
         .query_one("SELECT mz_environment_id()", &[])
         .await?
@@ -1151,6 +1190,8 @@ async fn create_materialize_state(
         http_addr: materialize_http_addr,
         internal_sql_addr: materialize_internal_sql_addr,
         internal_http_addr: materialize_internal_http_addr,
+        password_sql_addr: materialize_password_sql_addr,
+        sasl_sql_addr: materialize_sasl_sql_addr,
         user: materialize_user,
         pgclient,
         environment_id,
diff --git a/src/testdrive/src/bin/testdrive.rs b/src/testdrive/src/bin/testdrive.rs
@@ -159,6 +159,20 @@ struct Args {
     /// The hostname is taken from `materialize_internal_url`.
     #[clap(long, default_value = "6878", value_name = "PORT")]
     materialize_internal_http_port: u16,
+    /// materialize password-protected SQL connection string.
+    #[clap(
+        long,
+        value_name = "PASSWORD_URL",
+        action = ArgAction::Set,
+    )]
+    materialize_password_sql_url: Option<tokio_postgres::Config>,
+    /// materialize SASL-protected SQL connection string.
+    #[clap(
+        long,
+        value_name = "SASL_URL",
+        action = ArgAction::Set,
+    )]
+    materialize_sasl_sql_url: Option<tokio_postgres::Config>,
     /// Arbitrary session parameters for testdrive to set after connecting to
     /// Materialize.
     #[clap(long, value_name = "KEY=VAL", value_parser = parse_kafka_opt)]
@@ -414,6 +428,8 @@ async fn main() {
         materialize_internal_pgconfig: args.materialize_internal_url,
         materialize_http_port: args.materialize_http_port,
         materialize_internal_http_port: args.materialize_internal_http_port,
+        materialize_password_sql_url: args.materialize_password_sql_url,
+        materialize_sasl_sql_url: args.materialize_sasl_sql_url,
         materialize_use_https: args.materialize_use_https,
         materialize_params: args.materialize_param,
         materialize_catalog_config,
diff --git a/test/platform-checks/mzcompose.py b/test/platform-checks/mzcompose.py
@@ -17,7 +17,7 @@
 import os
 from enum import Enum
 
-from materialize import buildkite
+from materialize import MZ_ROOT, buildkite
 from materialize.checks.all_checks import *  # noqa: F401 F403
 from materialize.checks.checks import Check
 from materialize.checks.executors import MzcomposeExecutor, MzcomposeExecutorParallel
@@ -70,15 +70,21 @@ def create_mzs(
             blob_store_is_azure=azurite,
             sanity_restart=False,
             volumes_extra=["secrets:/share/secrets"],
-            additional_system_parameter_defaults=additional_system_parameter_defaults,
+            additional_system_parameter_defaults=(
+                (additional_system_parameter_defaults or {})
+                | {"enable_password_auth": "true"}
+            ),
             default_replication_factor=default_replication_factor,
             support_external_clusterd=True,
+            listeners_config_path=f"{MZ_ROOT}/src/materialized/ci/listener_configs/mixed_auth.json",
         )
         for mz_name in ["materialized", "mz_1", "mz_2", "mz_3", "mz_4", "mz_5"]
     ] + [
         TestdriveService(
             default_timeout=TESTDRIVE_DEFAULT_TIMEOUT,
             materialize_params={"statement_timeout": f"'{TESTDRIVE_DEFAULT_TIMEOUT}'"},
+            materialize_password_sql_url="postgres://materialize@materialized:6885",
+            materialize_sasl_sql_url="postgres://materialize@materialized:6895",
             external_blob_store=external_blob_store,
             blob_store_is_azure=azurite,
             no_reset=True,
