apache / apache/pulsar

JWT authentication and authorization not working on standalone cluster

Open
#13,743 6 comments 0 reactions 0 assignees View on GitHub
lifecycle/stale Stale type/bug
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

**Describe the bug**
I'm trying to add JWT authentication and Authorization on a standalone apache pulsar, but seems it is not working for me.
So basically right now the state is: Without token -- Client is able to produce and consume messages.

**To Reproduce**
Steps to reproduce
1. Create Tenant with admin roles
pulsar-admin tenants create my-first-tenant --admin-roles testadmin

2. Create Namespace under tenant
pulsar-admin namespaces create my-first-tenant/my-first-namespace

3. Create non-partitioned topic
pulsar-admin topics create persistent://my-first-tenant/my-first-namespace/my-first-topic

pulsar-admin namespaces grant-permission my-first-tenant/my-first-namespace --role testadmin --actions produce,consume

4. Create secret key
pulsar tokens create-secret-key --output /home/xxx/secret.key --base64

5. Generate token using secret key
pulsar tokens create --secret-key file:///home/xxx/secret.key --subject testadmin

Changes made to the broker.conf
• authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
• authorizationProvider=org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider
• brokerClientTlsEnabled=true #false
• brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken #
• brokerClientAuthenticationParameters={"token":"value of token"}
• tokenSecretKey=file:///home/ankita/Acrolinx/apache-pulsar-2.9.1/tokens/secret.key
• proxyRoles=testadmin
• superUserRoles=testadmin

Chnages made to proxy.conf
• authenticationEnabled=true
• authorizationEnabled=true
• authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
• tokenSecretKey=file:///path/to/secret.key
• superUserRoles=testadmin
• brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
• brokerClientAuthenticationParameters={"token":"value of token"}
• forwardAuthorizationCredentials=true

Changes made to Standalone.conf
• authenticationEnabled=true
• authorizationEnabled=true
• authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
• tokenSecretKey=file:///path/to/secret.key
• superUserRoles=testadmin
• brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
• brokerClientAuthenticationParameters={"token":"value of token"}

Changes made to client.conf
• authPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
• authParams=token:value of token

**Expected behavior**
I expect the client should not be able to produce or consume messages without token

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**
- OS: [Debian]

**Additional context**

Contributor guide

Open the contributing guide

Research direction

Start with the standalone configuration and the AuthenticationProviderToken settings, then compare broker.conf, proxy.conf, and client.conf while reproducing the listed tenant, namespace, and topic commands. Done means an unauthenticated client is denied produce and consume access while the token-authenticated testadmin client retains its granted permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, authorization, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.