[GitHub] [pulsar] RobertIndie commented on a change in pull request #10685: [Broker] Add multi roles support for authentication and authorization

[GitBox <gi...@apache.org>]

RobertIndie commented on a change in pull request #10685:
URL: https://github.com/apache/pulsar/pull/10685#discussion_r637806980



##########
File path: pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java
##########
@@ -149,7 +150,13 @@ public String authenticate(AuthenticationDataSource authData) throws Authenticat
             String token;
             token = getToken(authData);
             // Parse Token by validating
-            String role = getPrincipal(authenticateToken(token));
+            String role;
+            List<String> principals = getPrincipals(authenticateToken(token));
+            if (principals == null) { // Empty list check has been done in getPrincipals.
+                role = null;
+            } else {
+                role = principals.get(0);

Review comment:
       Thanks for your review. 
   This is for being compatible with the original single role authentication. I just changed it to multi roles authenticate method in https://github.com/apache/pulsar/pull/10685/commits/cf646e47ea6f83dd596fff882c644471698045c1  to make it support both single role and multi roles authentication.
   For authorization, we use `AuthenticationState.getAuthRoles()` to get the roles array in [`ServerCnx`](https://github.com/RobertIndie/pulsar/blob/cf646e47ea6f83dd596fff882c644471698045c1/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java#L630), then use this array to authorize. It doesn't go through this `authenticate` method. ([Detail](https://github.com/RobertIndie/pulsar/blob/cf646e47ea6f83dd596fff882c644471698045c1/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L203))




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org