You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "sayginify (via GitHub)" <gi...@apache.org> on 2023/11/27 14:03:00 UTC
[I] [Bug] Enabling Authorization only on Proxy [pulsar]
sayginify opened a new issue, #21627:
URL: https://github.com/apache/pulsar/issues/21627
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
2.9.3
### Minimal reproduce step
I have the following (shortened) proxy.conf file :
```
zookeeperServers=pulsar-zookeeper
configurationStoreServers=pulsar-zookeeper
brokerServiceURL=
brokerServiceURLTLS=
brokerWebServiceURL=
brokerWebServiceURLTLS=
functionWorkerWebServiceURL=
functionWorkerWebServiceURLTLS=
zookeeperSessionTimeoutMs=30000
zooKeeperCacheExpirySeconds=300
bindAddress=0.0.0.0
haProxyProtocolEnabled=false
servicePort=6650
servicePortTls=6651
webServicePort=80
webServicePortTls=443
authorizationEnabled=true
authorizationProvider=com.intenseye.pulsar.auth.SayginAuthorizationProvider
forwardAuthorizationCredentials=false
authenticationEnabled=true
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
brokerClientAuthenticationPlugin=
brokerClientAuthenticationParameters=
brokerClientTrustCertsFilePath=/pulsar/certs/ca/ca.crt
tlsEnabledWithBroker=true
tlsCertRefreshCheckDurationSec=300
tlsEnabledInProxy=true
tlsCertificateFilePath=/pulsar/certs/proxy/tls.crt
tlsKeyFilePath=/pulsar/certs/proxy/tls.key
tlsTrustCertsFilePath=/pulsar/certs/ca/ca.crt
tlsAllowInsecureConnection=false
tlsHostnameVerificationEnabled=false
tlsRequireTrustedClientCertOnConnect=false
tokenSecretKey=file:///pulsar/auth/jwt/proxy-private.key
### --- Deprecated config variables --- ###
# Deprecated. Use configurationStoreServers
globalZookeeperServers=
configurationMetadataStoreUrl=pulsar-zookeeper:2184
metadataStoreUrl=pulsar-zookeeper:2181
```
### What did you expect to see?
I have two roles granted permission to consume topicst in to separate namespaces
role-1 -> namespace-1
role2 -> namespace-2
I expect role-1 NOT to consume topics in namespace-2
I expect role-2 NOT to consume topics in namespace-1
### What did you see instead?
All roles can subscribe to any topics within any namespaces listed.
### Anything else?
I've set an example by my custom provider, but using PulsarAuthorizationProvider (by default) also produces the same behavior. I only extended that class and added some logs inside, to see if it actually comes in any of the authorization methods.
I did NOT set brokerServiceURL or brokerServiceURLTLS on purpose, because I've read on [one of the issues](https://github.com/apache/pulsar/issues/7385) that enabling those automatically disables authorization Proxy. So instead I've set zookeeper discovery, which has been done successfully.
I don't want to change broker configuration, and I'm aware that skipping authentication / authorization between proxy and broker is a security leak, yet I'm fine with that.
What am I missing? How should I enable authorization only on proxy ?
Note : Authentication works perfectly without any problem on proxy side.
Note2 : I've set all even though it says deprecated for some configs, they seem to be necessary.
zookeeperServers=pulsar-zookeeper
configurationStoreServers=pulsar-zookeeper
configurationMetadataStoreUrl=pulsar-zookeeper:2184
metadataStoreUrl=pulsar-zookeeper:2181
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Enabling Authorization only on Proxy [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on issue #21627:
URL: https://github.com/apache/pulsar/issues/21627#issuecomment-6381705915
Thanks @sayginify for the report. Topic-level authorization (who may produce, consume or look up a topic) is enforced by the brokers, not by the proxy: the proxy forwards the client's role (with `forwardAuthorizationCredentials=true`) and the broker authorizes it. On current master the proxy's `authorizationEnabled` only controls the super-user check on the proxy's own HTTP endpoints, such as `/proxy-stats` (see `ProxyStats.java` and `ProxyService.start()`), so authorization only on the proxy is not a supported setup. To restrict roles to namespaces, enable `authorizationEnabled=true` on the brokers and set `forwardAuthorizationCredentials=true` on the proxy.
I'm closing this as working as designed. If you still see a problem on a currently supported release (4.0.x, 4.2.x or 5.0.x) with authorization enabled on the brokers, please reopen with the configuration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Enabling Authorization only on Proxy [pulsar]
Posted by "sayginify (via GitHub)" <gi...@apache.org>.
sayginify commented on issue #21627:
URL: https://github.com/apache/pulsar/issues/21627#issuecomment-1831466857
> Proxy forwards the requests. You cannot just enable authorization on the proxy.
as far as I understood from the document, I can enable authorization on the proxy :
https://pulsar.apache.org/docs/2.9.x/administration-proxy/
_Proxy authorization requires access to ZooKeeper, so if you use these broker URLs to connect to the brokers, you need to disable authorization at the Proxy level. Brokers still authorize requests after the proxy forwards them._
I enabled access to ZooKeeper, and I removed brokerURL settings as I've provided in the config above. I can confirm that Proxy connects to ZooKeeper and discovers the broker through zk as well.
So, I think I should be able to enable authorization on the proxy
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Enabling Authorization only on Proxy [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat closed issue #21627: [Bug] Enabling Authorization only on Proxy
URL: https://github.com/apache/pulsar/issues/21627
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Enabling Authorization only on Proxy [pulsar]
Posted by "Technoboy- (via GitHub)" <gi...@apache.org>.
Technoboy- commented on issue #21627:
URL: https://github.com/apache/pulsar/issues/21627#issuecomment-1831448809
Proxy forwards the requests. You cannot just enable authorization on the proxy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org