[I] [Bug] List Clusters API has no Authorization Check [pulsar]

["shasank112001 (via GitHub)" <gi...@apache.org>]

shasank112001 opened a new issue, #26100:
URL: https://github.com/apache/pulsar/issues/26100

   ### Search before reporting
   
   - [x] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
   
   
   ### Read release policy
   
   - [x] I understand that [unsupported versions](https://pulsar.apache.org/contribute/release-policy/#supported-versions) don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.
   
   
   ### User environment
   
   Pulsar Version 4.1.3
   Broker Java Version: 17
   Client Library Version: 4.1.3
   
   ### Issue Description
   
   The list-clusters API has no Authorization check, allowing any user to list all clusters.  The ClusterOperations class, along with the Authorization Provider, does have the capability to forbid these operations, but as the authorization layer is never invoked by the getCluster function, shown below:
   ```java
   @GET
       @ApiOperation(
               value = "Get the list of all the Pulsar clusters.",
               response = String.class,
               responseContainer = "Set")
       @ApiResponses(value = {
               @ApiResponse(code = 200, message = "Return a list of clusters."),
               @ApiResponse(code = 500, message = "Internal server error.")
       })
       public void getClusters(@Suspended AsyncResponse asyncResponse) {
           clusterResources().listAsync()
                   .thenApply(clusters -> clusters.stream()
                           // Remove "global" cluster from returned list
                           .filter(cluster -> !Constants.GLOBAL_CLUSTER.equals(cluster))
                           .collect(Collectors.toSet()))
                   .thenAccept(asyncResponse::resume)
                   .exceptionally(ex -> {
                       log.error("[{}] Failed to get clusters {}", clientAppId(), ex);
                       resumeAsyncResponseExceptionally(asyncResponse, ex);
                       return null;
                   });
       }
   ```
   
   All users are allowed to get clusters.
   
   
   ### Error messages
   
   ```text
   
   ```
   
   ### Reproducing the issue
   
   1. Start a pulsar standalone cluster with Authentication and Authorization.
   2. Call the cluster-list API with a trusted client, that has no authorizations on the platform.
   
   ### Additional information
   
   _No response_
   
   ### Are you willing to submit a PR?
   
   - [x] I'm willing to submit a PR!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] List Clusters API has no Authorization Check [pulsar]

["merlimat (via GitHub)" <gi...@apache.org>]

merlimat closed issue #26100: [Bug] List Clusters API has no Authorization Check
URL: https://github.com/apache/pulsar/issues/26100


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org