You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "dragonls (via GitHub)" <gi...@apache.org> on 2025/12/31 03:39:13 UTC
[PR] [fix][broker] Fix MultiRolesTokenAuthorizationProvider error when subscription prefix doesn't match. [pulsar]
dragonls opened a new pull request, #25121:
URL: https://github.com/apache/pulsar/pull/25121
### Motivation
When using `MultiRolesTokenAuthorizationProvider` with multiple roles in a JWT token, if one of the roles fails the subscription prefix check in `PulsarAuthorizationProvider#canConsumeAsync`, it throws a `PulsarServerException` with the message "The subscription name needs to be prefixed by the authentication role".
This exception propagates up and causes the entire authorization to fail, even if another role in the token has valid permissions. This is problematic in multi-role scenarios where:
- A JWT token contains multiple roles (e.g., `["user-a", "user-b"]`)
- Only one role needs to have permission for the operation to succeed
- The `FutureUtil.waitForAny` mechanism should return success as soon as any role is authorized
### Modifications
Modified `MultiRolesTokenAuthorizationProvider#authorize` method to handle exceptions differently based on the number of roles:
1. **Single role**: Keep the original behavior - exceptions are propagated as-is. This ensures backward compatibility and proper error reporting when there's only one role.
2. **Multiple roles**: Swallow all exceptions and convert them to `false` (authorization failed). This allows `FutureUtil.waitForAny` to work correctly - if any role succeeds, the overall authorization succeeds; only if all roles fail (return `false` or throw exceptions), the authorization fails.
```java
if (roles.size() == 1) {
roles.forEach(r -> futures.add(authorizeFunc.apply(r)));
} else {
roles.forEach(r -> futures.add(authorizeFunc.apply(r).exceptionally(ex -> false)));
}
```
### Verifying this change
- [ ] Make sure that the change passes the CI checks.
This change added new test cases in `MultiRolesTokenAuthorizationProviderTest`:
- `testMultiRolesAuthzWithSubscriptionPrefixMismatchException`: Tests multi-role scenarios where:
- One role succeeds, another throws exception -> returns `true`
- All roles throw exceptions -> returns `false`
- `testSingleRoleAuthzWithSubscriptionPrefixMismatchException`: Tests single-role scenario where:
- Single role throws exception -> propagates the original exception
### Does this pull request potentially affect one of the following parts:
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
*If the box was checked, please highlight the changes*
- [ ] Dependencies (add or upgrade a dependency)
- [ ] The public API
- [ ] The schema
- [ ] The default values of configurations
- [ ] The threading model
- [ ] The binary protocol
- [ ] The REST endpoints
- [ ] The admin CLI options
- [ ] The metrics
- [ ] Anything that affects deployment
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
### Matching PR in forked repository
PR in forked repository: https://github.com/dragonls/pulsar/pull/12
<!--
After opening this PR, the build in apache/pulsar will fail and instructions will
be provided for opening a PR in the PR author's forked repository.
apache/pulsar pull requests should be first tested in your own fork since the
apache/pulsar CI based on GitHub Actions has constrained resources and quota.
GitHub Actions provides separate quota for pull requests that are executed in
a forked repository.
The tests will be run in the forked repository until all PR review comments have
been handled, the tests pass and the PR is approved by a reviewer.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][broker] Fix MultiRolesTokenAuthorizationProvider error when subscription prefix doesn't match. [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari merged PR #25121:
URL: https://github.com/apache/pulsar/pull/25121
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][broker] Fix MultiRolesTokenAuthorizationProvider error when subscription prefix doesn't match. [pulsar]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #25121:
URL: https://github.com/apache/pulsar/pull/25121#issuecomment-3705205596
## [Codecov](https://app.codecov.io/gh/apache/pulsar/pull/25121?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 74.47%. Comparing base ([`ff0d0eb`](https://app.codecov.io/gh/apache/pulsar/commit/ff0d0eb2ba97d96c8bc760a1dfe8255efa71d5c1?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`6c5afe2`](https://app.codecov.io/gh/apache/pulsar/commit/6c5afe2ead1b3f22c3f7d3c5f07a4e891404a761?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 1 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/pulsar/pull/25121?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## master #25121 +/- ##
============================================
- Coverage 74.82% 74.47% -0.35%
+ Complexity 33836 33659 -177
============================================
Files 1899 1899
Lines 149656 149658 +2
Branches 17393 17394 +1
============================================
- Hits 111979 111457 -522
- Misses 28892 29329 +437
- Partials 8785 8872 +87
```
| [Flag](https://app.codecov.io/gh/apache/pulsar/pull/25121/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [inttests](https://app.codecov.io/gh/apache/pulsar/pull/25121/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `26.37% <0.00%> (-0.52%)` | :arrow_down: |
| [systests](https://app.codecov.io/gh/apache/pulsar/pull/25121/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `23.11% <0.00%> (-0.10%)` | :arrow_down: |
| [unittests](https://app.codecov.io/gh/apache/pulsar/pull/25121/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `73.99% <100.00%> (-0.36%)` | :arrow_down: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
| [Files with missing lines](https://app.codecov.io/gh/apache/pulsar/pull/25121?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [...rization/MultiRolesTokenAuthorizationProvider.java](https://app.codecov.io/gh/apache/pulsar/pull/25121?src=pr&el=tree&filepath=pulsar-broker-common%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fpulsar%2Fbroker%2Fauthorization%2FMultiRolesTokenAuthorizationProvider.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-cHVsc2FyLWJyb2tlci1jb21tb24vc3JjL21haW4vamF2YS9vcmcvYXBhY2hlL3B1bHNhci9icm9rZXIvYXV0aG9yaXphdGlvbi9NdWx0aVJvbGVzVG9rZW5BdXRob3JpemF0aW9uUHJvdmlkZXIuamF2YQ==) | `69.15% <100.00%> (+0.58%)` | :arrow_up: |
... and [118 files with indirect coverage changes](https://app.codecov.io/gh/apache/pulsar/pull/25121/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org