[GitHub] [bookkeeper] Ghatage opened a new issue #2354: BP-41 Certificate role based authorization for Bookkeeper

[GitBox <gi...@apache.org>]

Ghatage opened a new issue #2354:
URL: https://github.com/apache/bookkeeper/issues/2354


   This is the master ticket for tracking BP-41.
   
   Even with TLS/mTLS authentication, any other service with rootCA is able to access Bookkeeper which is unacceptable as Bookkeeper is the source or truth.
   
   This feature allows a predefined set of roles to be 'whitelisted' to be able
   to access bookkeeper based on their client certificates.
   It also introduces a structure for these roles to adhere to in order to scale.
   
   Proposal PR - [Link](https://docs.google.com/document/d/15atmnl3pS4HrhQ6fV-gSY7faIVlmU91KoApBaXPjEfg/edit?usp=sharing)


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [bookkeeper] EronWright commented on issue #2354: Certificate role based authorization for Bookkeeper

[GitBox <gi...@apache.org>]

EronWright commented on issue #2354:
URL: https://github.com/apache/bookkeeper/issues/2354#issuecomment-772938432


   Just a comment on the BP itself, it is described as BP-41 but another proposal uses that identifier ([BP-41: Separate BookieId from Bookie Network Address](http://bookkeeper.apache.org/bps/BP-41-bookieid/)).  Meanwhile this proposal is not listed on the community site ([ref](http://bookkeeper.apache.org/community/bookkeeper_proposals/)).


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org