[GitHub] massakam opened a new pull request #3187: Enable specifying allowed offset when verifying athenz role token

[GitBox <gi...@apache.org>]

massakam opened a new pull request #3187: Enable specifying allowed offset when verifying athenz role token
URL: https://github.com/apache/pulsar/pull/3187
 
 
   ### Motivation
   
   We are using Athenz for client authentication. Occasionally, the following error occurs and client authentication fails.
   
   > [pulsar-web-28-7] ERROR com.yahoo.athenz.auth.token.Token - Token:validate: token=v=Z1;d=xxx;r=xxx;p=xxx;a=xxx;t=1544027514;e=1544034714;k=0;i=xxx.xxx.xxx.xxx : has future timestamp=1544027514 : current time=1544027513 : allowed offset=0
   
   This means that the timestamp included in the authentication token is more future than the server time. Since the difference between them is only 1 second, I think that the time of either server or client is slightly off.
   
   This error can be avoided by increasing the value of `allowed offset`. Currently, this value is set to 0 in Pulsar, but the default value in Athenz ZMS seems to be 300 seconds.
   https://github.com/yahoo/athenz/blob/93fe62c17f3ab4556c71c5136c1646df4a874a5f/servers/zms/conf/zms.properties#L277-L280
   
   ### Modifications
   
   * Changed the default value of `allowed offset` from 0 to 30 (I think 300 seconds is too long)
   * Enabled specifying `allowed offset` using system property
   
   ### Result
   
   Even if the time of the server or client is slightly off, the authentication will succeed.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services