[PR] [improve][broker] Support OpenID multi-role authorization and improve proxy authentication defaults [pulsar]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari opened a new pull request, #26549:
URL: https://github.com/apache/pulsar/pull/26549

   ### Motivation
   
   Enable `MultiRolesTokenAuthorizationProvider` to work with `AuthenticationProviderOpenID` by reusing the configured authentication providers to validate tokens and extract role claims. This lets multi-role authorization use the same token handling and OpenID configuration as authentication.
   
   Align proxy and broker defaults so that forwarding client credentials and authenticating the original client are enabled together, reducing the configuration needed for token authentication through a proxy and helping avoid misconfiguration.
   
   ### Modifications
   
   - Add a shared token-role interface implemented by the Token and OpenID authentication providers, including support for configurations that use both providers. Multi-role authorization reuses their initialized instances, token parsers, and caches.
   - Add an `AuthorizationProvider.InitialContext` record containing `ServiceConfiguration`, `PulsarResources`, and `AuthenticationService`. Deprecate the previous initializer while preserving compatibility for existing authorization providers.
   - Allow multi-role authorization with any authentication provider implementing `TokenAuthenticationProvider`, with clear initialization errors when the shared token provider does not implement it.
   - Default `forwardAuthorizationCredentials` and `authenticateOriginalAuthData` to `true` in Java configuration, shipped configuration files, and deployment templates.
   - Document the explicit `authenticateOriginalAuthData=false` setting for TLS client-certificate authentication through a proxy and update the corresponding test fixtures.
   
   ### Verifying this change
   
   - Add coverage for OpenID multi-role authorization, Token/OpenID provider combinations, role-claim formats, asynchronous role extraction, shared-provider lifecycle, and initializer compatibility.
   - Extend proxy JWT tests to cover the default subject claim, a custom role claim, and multi-role authorization, verifying client topic permissions with the default proxy/broker configuration.
   - Run scoped broker-common, OpenID, broker, proxy, and websocket tests with retries disabled, plus `./gradlew quickCheck`.
   
   - [ ] Make sure that the change passes the CI checks.
   
   ### Does this pull request potentially affect one of the following parts:
   
   - [ ] Dependencies (add or upgrade a dependency)
   - [x] The public API — add the authorization initialization context and token-role interface; retain the deprecated initializer for existing providers.
   - [ ] The schema
   - [x] The default values of configurations — enable forwarding client credentials and authenticating the original client.
   - [ ] The threading model
   - [ ] The binary protocol
   - [ ] The REST endpoints
   - [ ] The admin CLI options
   - [x] The metrics — token validation during authorization uses the shared authentication provider's existing metrics.
   - [x] Anything that affects deployment — multi-role authorization requires a token provider implementing `TokenAuthenticationProvider`; TLS client-certificate proxy deployments need the explicit setting described above.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [improve][broker] Support OpenID multi-role authorization and improve proxy authentication defaults [pulsar]

["merlimat (via GitHub)" <gi...@apache.org>]

merlimat merged PR #26549:
URL: https://github.com/apache/pulsar/pull/26549


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org