[PR] [fix][broker] Apply the role logging anonymizer to topic authorization denial logs [pulsar]

["KannarFr (via GitHub)" <gi...@apache.org>]

KannarFr opened a new pull request, #26642:
URL: https://github.com/apache/pulsar/pull/26642

   ### Motivation
   
   PIP-402 added `authenticationRoleLoggingAnonymizer` so operators can keep roles out of broker logs.
   The warning `ServerCnx.isTopicOperationAllowed` logs when a topic operation is not allowed still
   printed `authRole` and `originalPrincipal` as is.
   
   `DefaultAuthenticationRoleLoggingAnonymizer.anonymize(null)` also failed with the `SHA256` and `MD5`
   anonymizers, while `originalPrincipal` is null for every client that does not connect through a proxy.
   
   ### Modifications
   
   - Pass `authRole` and `originalPrincipal` through the anonymizer in the topic authorization denial log.
   - Return null from `DefaultAuthenticationRoleLoggingAnonymizer.anonymize` for a null role.
   
   ### Verifying this change
   
   - [ ] Make sure that the change passes the CI checks.
   
   This change added tests and can be verified as follows:
     - Added `DefaultAuthenticationRoleLoggingAnonymizerTest`, covering a null role for every anonymizer
       type and the anonymized value of a role.
   
   ### Does this pull request potentially affect one of the following parts:
   
   - [ ] Dependencies (add or upgrade a dependency)
   - [ ] The public API
   - [ ] The schema
   - [ ] The default values of configurations
   - [ ] The threading model
   - [ ] The binary protocol
   - [ ] The REST endpoints
   - [ ] The admin CLI options
   - [ ] The metrics
   - [ ] Anything that affects deployment
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [fix][broker] Apply the role logging anonymizer to topic authorization denial logs [pulsar]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari merged PR #26642:
URL: https://github.com/apache/pulsar/pull/26642


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org