[fix][broker] Fix passing incorrect authentication data #16201

nodece · 2022-06-23T16:38:15Z

Signed-off-by: Zixuan Liu nodeces@gmail.com

Motivation

#16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue.

Modification

Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the getAuthenticationData(), this method name is easy to cause confusion and can not correctly get the authentication data

Verifying this change

Make sure that the change passes the CI checks.

Added unit test.

Documentation

doc-not-needed

BewareMyPower

The proxy tests still succeed without the modifications on ServerCnx

nodece · 2022-06-24T11:20:08Z

The proxy tests still succeed without the modifications on ServerCnx

You can try this step:

Clone this PR
Open org.apache.pulsar.proxy.server.ProxyWithJwtAuthorizationTest
Comment out the proxyConfig.setForwardAuthorizationCredentials(true); and conf.setAuthenticateOriginalAuthData(true);
Run org.apache.pulsar.proxy.server.ProxyWithJwtAuthorizationTest

org.apache.pulsar.proxy.server.ProxyWithJwtAuthorizationTest#testProxyAuthorization and org.apache.pulsar.proxy.server.ProxyWithJwtAuthorizationTest#testProxyAuthorizationWithPrefixSubscriptionAuthMode will fail.

BewareMyPower · 2022-06-24T11:33:19Z

Comment out the proxyConfig.setForwardAuthorizationCredentials(true); and conf.setAuthenticateOriginalAuthData(true);

So why did you add these two configs to tests?

In addition, it still succeeded.

nodece · 2022-06-24T14:54:38Z

These tests need to verify the originalPrincipal, we have to forward the client authentication data to the broker by proxy.

    /**
     * <pre>
     * It verifies jwt + Authentication + Authorization (client -> proxy -> broker).
     *
     * 1. client connects to proxy over jwt and pass auth-data
     * 2. proxy authenticate client and retrieve client-role
     *    and send it to broker as originalPrincipal over jwt
     * 3. client creates producer/consumer via proxy
     * 4. broker authorize producer/consumer create request using originalPrincipal
     *
     * </pre>
     */
    @Test
    public void testProxyAuthorization() throws Exception {

This is my test result:

BewareMyPower · 2022-06-24T15:10:45Z

I found the cause. It's because when I ran the tests, I have reverted your changes for ServerCnx.

Therefore, you must add another test to verify that when authenticaionEnabled and forwardAuthorizationCredentials are false, the authorization will succeed, which is unexpected. Otherwise it could be possible to introduce a regression in future because the tests would still pass if I reverted the changes for ServerCnx in this PR.

nodece · 2022-06-24T15:28:56Z

Your suggestion is great, I'll make a PR to do that.

BewareMyPower · 2022-06-24T15:30:03Z

I'm still confused about why #16065 introduced the bug? I just reverted e6b12c6 and run the ProxyWithJwtAuthorizationTest,ProxyWithJwtAuthorizationTest passed. i.e. it's not a regression.

But this PR makes ProxyWithJwtAuthorizationTest require the following configs:

        conf.setAuthenticateOriginalAuthData(true);
        proxyConfig.setForwardAuthorizationCredentials(true);

It looks like a breaking change on these configs.

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java

nodece · 2022-06-24T17:47:49Z

I'm still confused about why #16065 introduced the bug?

This bug is triggered only when the proxy is used, you can see this PR uses the getAuthenticationData() to get authentication data, when the proxy is used, it'll often use the proxy authentication data.

public AuthenticationDataSource getAuthenticationData() {
        return originalAuthData != null ? originalAuthData : authenticationData;
 }

The following is our test log:

2022-06-23T07:19:15,242+0000 [pulsar-io-4-1] DEBUG AuthorizationProviderOAuth - subject: client-role, scopes: [access], authzRoles: [
]
2022-06-23T07:19:15,242+0000 [pulsar-io-4-1] DEBUG org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider - Verify if role proxy-role is allowed to LOOKUP to topic per

The subject doesn't equal the role, it is incorrect.

I just reverted e6b12c6 and run the ProxyWithJwtAuthorizationTest,ProxyWithJwtAuthorizationTest passed. i.e. it's not a regression.

But this PR makes ProxyWithJwtAuthorizationTest require the following configs:
        conf.setAuthenticateOriginalAuthData(true);
        proxyConfig.setForwardAuthorizationCredentials(true);
It looks like a breaking change on these configs.

It was an accident, although the intermediate link of verification is incorrect, the test can still pass.

nodece · 2022-06-27T03:40:58Z

@BewareMyPower Thank you for pointing out this problem, you are right, I made a wrong design in the code that made the test fail.

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java

codelipenghui · 2022-06-28T07:59:32Z

@merlimat Please help review this PR.

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

utahkay · 2022-06-28T19:51:56Z

Could this please be picked into 2.8, 2.9 and 2.10?

### Motivation #16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue. ### Modification - Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the `getAuthenticationData()`, this method name is easy to cause confusion and can not correctly get the authentication data (cherry picked from commit 936bbbc)

nodece · 2022-06-29T02:03:38Z

Could this please be picked into 2.8, 2.9 and 2.10?

@codelipenghui Do you have this planning?

### Motivation apache#16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue. ### Modification - Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the `getAuthenticationData()`, this method name is easy to cause confusion and can not correctly get the authentication data (cherry picked from commit 936bbbc) Signed-off-by: Zixuan Liu <nodeces@gmail.com>

### Motivation apache#16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue. ### Modification - Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the `getAuthenticationData()`, this method name is easy to cause confusion and can not correctly get the authentication data (cherry picked from commit 936bbbc) (cherry picked from commit adf5ce7)

### Motivation apache#16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue. ### Modification - Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the `getAuthenticationData()`, this method name is easy to cause confusion and can not correctly get the authentication data (cherry picked from commit 936bbbc) Signed-off-by: Zixuan Liu <nodeces@gmail.com>

) ### Motivation #16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue. ### Modification - Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the `getAuthenticationData()`, this method name is easy to cause confusion and can not correctly get the authentication data (cherry picked from commit 936bbbc) Signed-off-by: Zixuan Liu <nodeces@gmail.com>

codelipenghui · 2022-07-28T03:31:23Z

@nodece Could you please open a PR for branch-2.8

### Motivation apache#16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue. ### Modification - Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the `getAuthenticationData()`, this method name is easy to cause confusion and can not correctly get the authentication data (cherry picked from commit 936bbbc) Signed-off-by: Zixuan Liu <nodeces@gmail.com>

) ### Motivation #16065 fixes the race condition issue, but introduces a new issue. This issue is triggered when the Proxy and Broker work together, when we use the proxy to request the broker to do lookup/subscribe/produce operation, the broker always uses the original authentication data for authorization, not proxy authentication data, which causes this issue. ### Modification - Fix passing authentication data, differentiate between original auth data and connected auth data by avoid to use the `getAuthenticationData()`, this method name is easy to cause confusion and can not correctly get the authentication data (cherry picked from commit 936bbbc) Signed-off-by: Zixuan Liu <nodeces@gmail.com>

nodece · 2022-08-02T07:22:44Z

@nodece Could you please open a PR for branch-2.8

See #16840.

congbobo184 assigned nodece Jun 23, 2022

nodece force-pushed the fix-broker-auth-data branch from 16fa583 to ff33ae5 Compare June 24, 2022 06:34

github-actions bot added the doc-not-needed label Jun 24, 2022

BewareMyPower requested review from merlimat, michaeljmarshall and mattisonchao June 24, 2022 08:56

BewareMyPower requested changes Jun 24, 2022

View reviewed changes

nodece commented Jun 24, 2022

View reviewed changes

pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java Outdated Show resolved Hide resolved

nodece force-pushed the fix-broker-auth-data branch 3 times, most recently from 95223ce to 6ba3293 Compare June 26, 2022 15:53

nodece requested a review from BewareMyPower June 26, 2022 16:03

nodece force-pushed the fix-broker-auth-data branch 2 times, most recently from f3b5671 to 3653e5c Compare June 27, 2022 03:33

codelipenghui added release/2.7.6 release/2.8.4 release/2.10.2 release/2.9.4 labels Jun 28, 2022

codelipenghui added this to the 2.11.0 milestone Jun 28, 2022

nodece requested review from codelipenghui and tuteng June 28, 2022 03:22

BewareMyPower requested changes Jun 28, 2022

View reviewed changes

codelipenghui requested a review from RobertIndie June 28, 2022 07:57

codelipenghui approved these changes Jun 28, 2022

View reviewed changes

Remove unused variables

79267d0

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

codelipenghui added doc-not-needed and removed doc-not-needed labels Jun 28, 2022

codelipenghui merged commit 936bbbc into apache:master Jun 28, 2022

This was referenced Jun 29, 2022

[branch-2.7][fix][broker] Fix passing incorrect authentication data #16278

Merged

[Test] Add an integration test to verify the authentication data source of authorization provider #16283

Closed

sijie mentioned this pull request Jun 29, 2022

ISSUE-16283: [Test] Add an integration test to verify the authentication data source of authorization provider streamnative/pulsar-archived#4451

Open

mattisonchao mentioned this pull request Jul 2, 2022

[Branch-2.9] Fix passing incorrect authentication data #16347

Merged

mattisonchao added the cherry-picked/branch-2.9 label Jul 2, 2022

Technoboy- added the cherry-picked/branch-2.7 label Jul 5, 2022

codelipenghui added the cherry-picked/branch-2.10 label Jul 10, 2022

BewareMyPower removed the release/2.8.4 label Jul 28, 2022

Jason918 added release/2.7.5 and removed release/2.7.6 labels Jul 29, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[fix][broker] Fix passing incorrect authentication data #16201

[fix][broker] Fix passing incorrect authentication data #16201

nodece commented Jun 23, 2022 •

edited

Loading

Uh oh!

BewareMyPower left a comment

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

BewareMyPower commented Jun 24, 2022

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

BewareMyPower commented Jun 24, 2022 •

edited

Loading

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

BewareMyPower commented Jun 24, 2022

Uh oh!

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

nodece commented Jun 27, 2022 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codelipenghui commented Jun 28, 2022

Uh oh!

utahkay commented Jun 28, 2022

Uh oh!

nodece commented Jun 29, 2022

Uh oh!

codelipenghui commented Jul 28, 2022

Uh oh!

nodece commented Aug 2, 2022

Uh oh!

[fix][broker] Fix passing incorrect authentication data #16201

[fix][broker] Fix passing incorrect authentication data #16201

Conversation

nodece commented Jun 23, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Modification

Verifying this change

Documentation

Uh oh!

BewareMyPower left a comment

Choose a reason for hiding this comment

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

BewareMyPower commented Jun 24, 2022

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

BewareMyPower commented Jun 24, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

BewareMyPower commented Jun 24, 2022

Uh oh!

Uh oh!

nodece commented Jun 24, 2022

Uh oh!

nodece commented Jun 27, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codelipenghui commented Jun 28, 2022

Uh oh!

utahkay commented Jun 28, 2022

Uh oh!

nodece commented Jun 29, 2022

Uh oh!

codelipenghui commented Jul 28, 2022

Uh oh!

nodece commented Aug 2, 2022

Uh oh!

nodece commented Jun 23, 2022 •

edited

Loading

BewareMyPower commented Jun 24, 2022 •

edited

Loading

nodece commented Jun 27, 2022 •

edited

Loading