You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "shasank112001 (via GitHub)" <gi...@apache.org> on 2025/12/10 17:50:55 UTC
[I] [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages [pulsar]
shasank112001 opened a new issue, #25062:
URL: https://github.com/apache/pulsar/issues/25062
### Search before reporting
- [x] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Read release policy
- [x] I understand that [unsupported versions](https://pulsar.apache.org/contribute/release-policy/#supported-versions) don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.
### User environment
Broker Version 4.1.0
Broker Java Version 17
Client Library Type: Java
Client Library Version: 4.1.0
Client Java Version: 17
### Issue Description
I have the following cluster setup running locally:
1. Pulsar Proxy:
1. AuthenticationProviders: AuthenticationKeyStoreTLS, and JWT Authentication.
2. AuthenticationEnabled: true
3. BrokerClientParams: AuthenticationKeyStoreTLS
4. forwardAuthorizationCredentials: true
5. authenticationRefreshCheckSeconds: 5 seconds
2. Pulsar Broker:
1. AuthenticationProviders: AuthenticationKeyStoreTLS
2. AuthenticationEnabled: true
3. BrokerClientParams: AuthenticationKeyStoreTLS
5. authenticateOriginalAuthData: false
3. Pulsar Client:
1. Authentication class: JWT
Test case:
1. Client connects with a JWT token expiring in the next minute
2. Client produces messages at 1 msg/sec
Expected Result:
1. Client should produce for the first minute, and then stop with a PulsarClientException when Proxy reauthenticates the token
Observation:
1. Proxy runs r-authentication, prints that the token has expired. Prints disconnect message
2. Client prints the following messages:
```
[pulsar-client-io-18-3] WARN org.apache.pulsar.client.impl.ClientCnx - [id: 0x9ed69246, L:/127.0.0.1:62086 - R:localhost/127.0.0.1:62066] Received error from server: Failed to authenticate
[pulsar-client-io-18-3] ERROR org.apache.pulsar.client.impl.ClientCnx - [id: 0x9ed69246, L:/127.0.0.1:62086 - R:localhost/127.0.0.1:62066] Failed to authenticate the client
[pulsar-client-io-18-3] WARN org.apache.pulsar.client.impl.ClientCnx - [id: 0x9ed69246, L:/127.0.0.1:62086 - R:localhost/127.0.0.1:62066] Received unknown request id from server: -1
[pulsar-client-io-18-3] INFO org.apache.pulsar.client.impl.ClientCnx - [id: 0x9ed69246, L:/127.0.0.1:62086 ! R:localhost/127.0.0.1:62066] Disconnected
[pulsar-timer-62-1] INFO org.apache.pulsar.client.impl.ProducerStatsRecorderImpl - [persistent://security-test/security-namespace/security] [test-container-1-0-1] --- Publish throughput: 1.00 msg/s --- 0.00 Mbit/s --- Latency: med: 6.000 ms - 95pct: 20.000 ms - 99pct: 25.000 ms - 99.9pct: 25.000 ms - max: 25.000 ms --- BatchSize: med: 1.000 - 95pct: 1.000 - 99pct: 1.000 - 99.9pct: 1.000 - max: 1.000 --- MsgSize: med: 36.000 bytes - 95pct: 36.000 bytes - 99pct: 36.000 bytes - 99.9pct: 36.000 bytes - max: 36.000 bytes --- Ack received rate: 1.00 ack/s --- Failed messages: 0 --- Pending messages: 0
```
However, the producer.send and consumer message listener are still able to send and receive messages:
```
Produced message with ID 2:60:-1
[pulsar-external-listener-33-1] INFO xxxx - Received message with 2:60:-1
[main] INFO xxxx - Produced message with ID 2:61:-1
[main] INFO xxxxx - Produced message with ID 2:62:-1
[pulsar-external-listener-33-1] INFO xxxx - Received message with 2:61:-1
[pulsar-external-listener-33-1] INFO xxxx - Received message with 2:62:-1
```
### Error messages
```text
```
### Reproducing the issue
Run the cluster with the above mentioned configuration, with a docker compose and not pulsar standalone.
Add the same configuration as mentioned above and try to run a producer and consumer with a near-expiry JWT token.
### Additional information
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages [pulsar]
Posted by "shasank112001 (via GitHub)" <gi...@apache.org>.
shasank112001 closed issue #25062: [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages
URL: https://github.com/apache/pulsar/issues/25062
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages [pulsar]
Posted by "shasank112001 (via GitHub)" <gi...@apache.org>.
shasank112001 commented on issue #25062:
URL: https://github.com/apache/pulsar/issues/25062#issuecomment-3646174039
But then I believe we should document this, as authenticateOriginalAuthData is incompatible with mTLS, as proxies can only do reencrypt traffic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on issue #25062:
URL: https://github.com/apache/pulsar/issues/25062#issuecomment-3646197957
> But then I believe we should document this, as authenticateOriginalAuthData is incompatible with mTLS, as proxies can only do reencrypt traffic.
Yes, contributions to improve the documentation are welcome!
Renaming the issue would also be useful since "Client says disconnected but producer and consumer can still produce/consume messages" isn't a bug.
It's likely that the mTLS use case isn't supported currently with token expiration check. We could also close this current issue and have a new one for the real gap.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on issue #25062:
URL: https://github.com/apache/pulsar/issues/25062#issuecomment-3645596098
> 2\. 5. authenticateOriginalAuthData: false
This seems to be the problem. https://github.com/apache/pulsar/issues/7824#issuecomment-693257733
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on issue #25062:
URL: https://github.com/apache/pulsar/issues/25062#issuecomment-3645604807
> [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages
The reason for this behavior is that in the case of using Pulsar Proxy, there will be a separate lookup connection to the proxy and separate data connections via the Proxy to brokers. The proxy won't intercept the traffic for data connections after the handshake is complete. That's why it's necessary to enable `authenticateOriginalAuthData` on brokers for token expiration check to work.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] [Pulsar-Client] Client says disconnected but producer and consumer can still produce/consume messages [pulsar]
Posted by "shasank112001 (via GitHub)" <gi...@apache.org>.
shasank112001 commented on issue #25062:
URL: https://github.com/apache/pulsar/issues/25062#issuecomment-3646455101
I think creating a new Issue with a feature tag would be best. I will create one and close this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org