[GitHub] ivankelly commented on issue #1991: TLS auth cannot be used between proxy and brokers

[GitBox <gi...@apache.org>]

ivankelly commented on issue #1991: TLS auth cannot be used between proxy and brokers
URL: https://github.com/apache/incubator-pulsar/issues/1991#issuecomment-399403061
 
 
   My original hunch on the advertising being wrong was incorrect. It does in fact go to the correct address if you have the right set of options configured.
   
   my proxy.conf tls bits
   ```
   authenticationEnabled=true
   authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls
   authorizationEnabled=true
   brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
   brokerClientAuthenticationParameters=tlsCertFile:/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/client-keys/admin.cert.pem,tlsKeyFile:/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/client-keys/admin.key-pk8.pem
   brokerClientTrustCertsFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/certs/ca.cert.pem                                                                                                               
   tlsEnabledInProxy=true
   tlsEnabledWithBroker=true
   tlsCertificateFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/server-keys/broker.cert.pem
   tlsKeyFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/server-keys/broker.key-pk8.pem
   tlsTrustCertsFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/certs/ca.cert.pem
   tlsAllowInsecureConnection=true
   ```
   
   my broker.conf tls bits
   ```
   tlsEnabled=true
   tlsCertificateFilePath=/pulsar/ssl/broker.cert.pem
   tlsKeyFilePath=/pulsar/ssl/broker.key-pk8.pem
   tlsTrustCertsFilePath=/pulsar/ssl/ca.cert.pem
   authenticationEnabled=true
   authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls
   superUserRoles=admin
   authorizationEnabled=true
   ```
   
   tlsAllowInsecureConnection doesn't exist in the config file as is. It needs to be documented.
   
   This works for the brokerService port. I have another role "ivan".
   If "ivan" tries to produce to public/default/topic1 via the proxy or broker, he cannot. If the admin user grants "ivan" produce action permissions on the public/default namespace, then he can write.
   
   However, if "ivan" uses they admin client against the proxy, he can grant himself any permissions he wants.
   
   This is because the proxy is authenticated against the broker as a superuser, anyone authenticated against the proxy gains those superuser powers. There's no forwarding of principal from the proxy for admin like there is for data.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services