You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2020/07/31 15:40:41 UTC
[GitHub] [pulsar] vzhikserg opened a new pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
vzhikserg opened a new pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712
Fixes #7711
### Motivation
A client can have more permissions than its original role allows and it is a security violation.
### Modifications
Use the original role (if available) instead of the proxy role to check if a client is allowed to consume or produce messages.
### Verifying this change
- [ ] Make sure that the change passes the CI checks.
*(Please pick either of the following options)*
This change is a trivial rework / code cleanup without any test coverage.
*(or)*
This change is already covered by existing tests, such as *(please describe tests)*.
*(or)*
This change added tests and can be verified as follows:
*(example:)*
- *Added integration tests for end-to-end deployment with large payloads (10MB)*
- *Extended integration test for recovery after broker failure*
### Does this pull request potentially affect one of the following parts:
*If `yes` was chosen, please highlight the changes*
- Dependencies (does it add or upgrade a dependency): (yes / no)
- The public API: (yes / no)
- The schema: (yes / no / don't know)
- The default values of configurations: (yes / no)
- The wire protocol: (yes / no)
- The rest endpoints: (yes / no)
- The admin cli options: (yes / no)
- Anything that affects deployment: (yes / no / don't know)
### Documentation
- Does this pull request introduce a new feature? (yes / no)
- If yes, how is the feature documented? (not applicable / docs / JavaDocs / not documented)
- If a feature is not applicable for documentation, explain why?
- If a feature is not documented yet in this PR, please create a followup issue for adding the documentation
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on a change in pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on a change in pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#discussion_r463988220
##########
File path: pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java
##########
@@ -557,9 +557,9 @@ private void validatePoliciesReadOnlyAccess() {
switch (operation) {
case LOOKUP: isAuthorizedFuture = canLookupAsync(topicName, role, authData);
Review comment:
the lookup method was updated
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667571165
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] jiazhai commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
jiazhai commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667761180
@vzhikserg Thanks for the help. Would you please help check whether the failed ci is related?
```
[ERROR] org.apache.pulsar.broker.admin.TopicBacklogQuotaTest.testRemoveBacklogQuota(org.apache.pulsar.broker.admin.TopicBacklogQuotaTest)
[INFO] Run 1: PASS
[ERROR] Run 2: TopicBacklogQuotaTest.testRemoveBacklogQuota:113 ? ServerSideError HTTP 500 In...
[INFO]
[ERROR] org.apache.pulsar.broker.admin.TopicBacklogQuotaTest.testSetBacklogQuota(org.apache.pulsar.broker.admin.TopicBacklogQuotaTest)
[INFO] Run 1: PASS
[ERROR] Run 2: TopicBacklogQuotaTest.testSetBacklogQuota:92 ? ServerSideError HTTP 500 Intern...
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667663491
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667686934
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] codelipenghui merged pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
codelipenghui merged pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667670856
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] jiazhai removed a comment on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
jiazhai removed a comment on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667761180
@vzhikserg Thanks for the help. Would you please help check whether the failed ci is related?
```
[ERROR] org.apache.pulsar.broker.admin.TopicBacklogQuotaTest.testRemoveBacklogQuota(org.apache.pulsar.broker.admin.TopicBacklogQuotaTest)
[INFO] Run 1: PASS
[ERROR] Run 2: TopicBacklogQuotaTest.testRemoveBacklogQuota:113 ? ServerSideError HTTP 500 In...
[INFO]
[ERROR] org.apache.pulsar.broker.admin.TopicBacklogQuotaTest.testSetBacklogQuota(org.apache.pulsar.broker.admin.TopicBacklogQuotaTest)
[INFO] Run 1: PASS
[ERROR] Run 2: TopicBacklogQuotaTest.testSetBacklogQuota:92 ? ServerSideError HTTP 500 Intern...
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg removed a comment on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg removed a comment on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667588386
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] jiazhai commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
jiazhai commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667761216
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667319999
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667244022
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667405243
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] jiazhai commented on a change in pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
jiazhai commented on a change in pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#discussion_r463900930
##########
File path: pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java
##########
@@ -557,9 +557,9 @@ private void validatePoliciesReadOnlyAccess() {
switch (operation) {
case LOOKUP: isAuthorizedFuture = canLookupAsync(topicName, role, authData);
Review comment:
does lookup also need a change?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667588386
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] jiazhai commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
jiazhai commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667790056
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg removed a comment on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg removed a comment on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-667244022
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] vzhikserg commented on pull request #7712: [Issue 7711][pulsar-broker] Use original role instead of proxy role to check permissions
Posted by GitBox <gi...@apache.org>.
vzhikserg commented on pull request #7712:
URL: https://github.com/apache/pulsar/pull/7712#issuecomment-668794582
/pulsarbot run-failure-checks
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org