(pulsar) branch master updated: [fix][broker] Apply the role logging anonymizer to topic authorization denial logs (#26642)

[lh...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lhotari pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar.git


The following commit(s) were added to refs/heads/master by this push:
     new 03174f696d4b [fix][broker] Apply the role logging anonymizer to topic authorization denial logs (#26642)
03174f696d4b is described below

commit 03174f696d4b3d3cc80d1f5baf90169856bc6636
Author: kannar <ka...@gmail.com>
AuthorDate: Sat Sep 19 17:04:59 2026 +0200

    [fix][broker] Apply the role logging anonymizer to topic authorization denial logs (#26642)
    
    Apply the configured role logging anonymizer consistently to topic authorization denial logs.
---
 ...DefaultAuthenticationRoleLoggingAnonymizer.java |  3 +-
 ...ultAuthenticationRoleLoggingAnonymizerTest.java | 42 ++++++++++++++++++++++
 .../apache/pulsar/broker/service/ServerCnx.java    |  4 +--
 3 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/pulsar-broker-common/src/main/java/org/apache/pulsar/common/configuration/anonymizer/DefaultAuthenticationRoleLoggingAnonymizer.java b/pulsar-broker-common/src/main/java/org/apache/pulsar/common/configuration/anonymizer/DefaultAuthenticationRoleLoggingAnonymizer.java
index 151118c6d5e4..9f94230e7818 100644
--- a/pulsar-broker-common/src/main/java/org/apache/pulsar/common/configuration/anonymizer/DefaultAuthenticationRoleLoggingAnonymizer.java
+++ b/pulsar-broker-common/src/main/java/org/apache/pulsar/common/configuration/anonymizer/DefaultAuthenticationRoleLoggingAnonymizer.java
@@ -62,6 +62,7 @@ public final class DefaultAuthenticationRoleLoggingAnonymizer {
    }
 
    public String anonymize(String role) {
-      return anonymizerType.anonymize(role);
+      // originalPrincipal is null for clients that do not connect through a proxy
+      return role == null ? null : anonymizerType.anonymize(role);
    }
 }
diff --git a/pulsar-broker-common/src/test/java/org/apache/pulsar/common/configuration/anonymizer/DefaultAuthenticationRoleLoggingAnonymizerTest.java b/pulsar-broker-common/src/test/java/org/apache/pulsar/common/configuration/anonymizer/DefaultAuthenticationRoleLoggingAnonymizerTest.java
new file mode 100644
index 000000000000..1adaa597638f
--- /dev/null
+++ b/pulsar-broker-common/src/test/java/org/apache/pulsar/common/configuration/anonymizer/DefaultAuthenticationRoleLoggingAnonymizerTest.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.pulsar.common.configuration.anonymizer;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNull;
+import org.testng.annotations.Test;
+
+public class DefaultAuthenticationRoleLoggingAnonymizerTest {
+
+    @Test
+    public void testNullRoleIsKeptForEveryType() {
+        // originalPrincipal is null for clients that do not connect through a proxy
+        for (DefaultRoleAnonymizerType type : DefaultRoleAnonymizerType.values()) {
+            assertNull(new DefaultAuthenticationRoleLoggingAnonymizer(type.name()).anonymize(null), type.name());
+        }
+    }
+
+    @Test
+    public void testRoleIsAnonymized() {
+        assertEquals(new DefaultAuthenticationRoleLoggingAnonymizer("NONE").anonymize("role"), "role");
+        assertEquals(new DefaultAuthenticationRoleLoggingAnonymizer("REDACTED").anonymize("role"), "[REDACTED]");
+        assertEquals(new DefaultAuthenticationRoleLoggingAnonymizer("SHA256").anonymize("role").substring(0, 8),
+                "SHA-256:");
+    }
+}
diff --git a/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java b/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java
index b4da96ee1bef..f642ace7a045 100644
--- a/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java
+++ b/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java
@@ -689,8 +689,8 @@ public class ServerCnx extends PulsarHandler implements TransportCnx {
         result.thenAccept(isAuthorized -> {
             if (!isAuthorized) {
                 log.warn()
-                        .attr("authRole", authRole)
-                        .attr("originalPrincipal", originalPrincipal)
+                        .attr("authRole", authenticationRoleLoggingAnonymizer.anonymize(authRole))
+                        .attr("originalPrincipal", authenticationRoleLoggingAnonymizer.anonymize(originalPrincipal))
                         .attr("operation", operation)
                         .attr("topic", topicName)
                         .log("Role or OriginalRole is not authorized to perform operation on topic");