[GitHub] nkurihar opened a new issue #2749: Admin API via PulsarProxy with authentication fails

[GitBox <gi...@apache.org>]

nkurihar opened a new issue #2749: Admin API via PulsarProxy with authentication fails
URL: https://github.com/apache/pulsar/issues/2749
 
 
   I tried Admin API via PulsarProxy with Athenz authentication, and found a few unexpected behaviors. Please correct me if my expectation/understanding is wrong.
   
   #### 1. proxyRoles
   
   ##### Expected
   [`proxyRoles`](https://github.com/apache/pulsar/blob/90aa408b9ddc53629bdc5c0e540cf5335c34399b/conf/broker.conf#L206-L208) in broker.conf can be set to empty. 
   (In this case Proxy will be treated as a "normal" client)
   
   ##### Actual
   `proxyRoles` in broker.conf can NOT be set to empty.
   
   Because:
   [`validateOriginalPrincipal`](https://github.com/apache/pulsar/blob/90aa408b9ddc53629bdc5c0e540cf5335c34399b/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L158-L162) will return false when
   * request has `originalPrincipal`
   * `proxyRoles` is empty
   
   #### 2. Super user proxy
   
   ##### Expected
   A role can be both `proxyRoles` and [`superUserRoles`](https://github.com/apache/pulsar/blob/90aa408b9ddc53629bdc5c0e540cf5335c34399b/conf/broker.conf#L260-L262).
   
   ##### Actual
   A role can be both `proxyRoles` and `superUserRoles`.
   However, when we use this role as a "normal" client, its super user access to Admin API will fail.
   
   Because:
   Although the role behaves as a normal client, the process will enter [this if statement](https://github.com/apache/pulsar/blob/69071355ca03fac9e38f7501b37ca93ac19fef7b/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L182) (since the role is also in `proxyRoles`) and finally [throw an exception](https://github.com/apache/pulsar/blob/69071355ca03fac9e38f7501b37ca93ac19fef7b/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L187-L191) since [`originalPrincipalAuthorized`](https://github.com/apache/pulsar/blob/69071355ca03fac9e38f7501b37ca93ac19fef7b/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L185) is false. (here `originalPrincipal` is null)
   
   #### 3. Header for authentication
   
   ##### Expected
   HTTP header includes authentication data of proxy.
   
   ##### Actual
   HTTP header includes authentication data of original client.
   
   Example of HTTP header from proxy to broker:
   ```
   User-Agent: Jersey/2.23.2 (HttpUrlConnection 1.8.0_144)
   Host: <broker>:<broker-port>
   Accept: application/json
   Athenz-Role-Auth: <token of original client>
   Via: http/1.1 <proxy>
   X-Forwarded-For: <client-ip>
   X-Forwarded-Proto: http
   X-Forwarded-Host: <proxy>
   X-Forwarded-Server: <proxy-ip>
   X-Original-Principal: <role of original client>
   ```
   #### System configuration
   * Pulsar version: 2.1.1
   * broker.conf: `authenticateOriginalAuthData=false`
   * proxy.conf: `forwardAuthorizationCredentials=false`

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services