You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "crossoverJie (via GitHub)" <gi...@apache.org> on 2023/11/16 10:06:26 UTC
[I] [Bug] When I upgrade to 3.0, Client authorization failed; error:originalPrincipal cannot be a proxy role. [pulsar]
crossoverJie opened a new issue, #21583:
URL: https://github.com/apache/pulsar/issues/21583
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
3.0.1
### Minimal reproduce step
1. Use helm upgrade broker from `2.11.2` to `3.0.1`
2. The client failed to connect using a `proxy`.
3. Broker config:
```config
superUserRoles: broker-admin,admin,proxy-admin
proxyRoles: proxy-admin
```
### What did you expect to see?
Connect success.
### What did you see instead?
Client error:
```json
{"errorMsg":"org.apache.pulsar.client.api.PulsarClientException: Connection already closed","reqId":4223365016908863489, "remote":"/192.168.88.38:6650", "local":"/172.28.1.157:52368"}
```
Broker Warning log:
```
2023-11-16T09:39:15,290+0000 [pulsar-io-4-8] WARN org.apache.pulsar.broker.authorization.AuthorizationService - [/192.168.130.37:56342] Illegal combination of role [proxy-admin] and originalPrincipal [proxy-admin]: originalPrincipal cannot be a proxy role.
```
### Anything else?
When I modify `proxy-statefulset.yaml` make the `proxy` use the client's `token` in helm chart:
and broker config:
```config
superUserRoles: broker-admin,admin,proxy-admin
proxyRoles: admin
```
this work for me.
---
When I check the code:
https://github.com/apache/pulsar/blob/38360d06ba16fbf6339d325ae200d603850b47ec/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/AuthorizationService.java#L443-L465
I discovered that `authenticatedPrincipal` and `originalPrincipal` are equal to `proxy-admin`; I guess `originalPrincipal` should not be equals to `proxy-admin`.
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] When I upgrade to 3.0, Client authorization failed; error:originalPrincipal cannot be a proxy role. [pulsar]
Posted by "crossoverJie (via GitHub)" <gi...@apache.org>.
crossoverJie commented on issue #21583:
URL: https://github.com/apache/pulsar/issues/21583#issuecomment-1814638848
Thank you very much for @Technoboy- help.
I made a mistake here. The client was using a token with the role `proxy-admin`; however, it can function correctly if the role is changed to one that is *not* `proxy-admin`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] When I upgrade to 3.0, Client authorization failed; error:originalPrincipal cannot be a proxy role. [pulsar]
Posted by "crossoverJie (via GitHub)" <gi...@apache.org>.
crossoverJie closed issue #21583: [Bug] When I upgrade to 3.0, Client authorization failed; error:originalPrincipal cannot be a proxy role.
URL: https://github.com/apache/pulsar/issues/21583
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org