JWT authentication and authorization not working on standalone cluster
- Dominant language
- Java
- Stars
- 15.3k
- Forks
- 3.8k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 160
Description
**Describe the bug**
I'm trying to add JWT authentication and Authorization on a standalone apache pulsar, but seems it is not working for me.
So basically right now the state is: Without token -- Client is able to produce and consume messages.
**To Reproduce**
Steps to reproduce
1. Create Tenant with admin roles
pulsar-admin tenants create my-first-tenant --admin-roles testadmin
2. Create Namespace under tenant
pulsar-admin namespaces create my-first-tenant/my-first-namespace
3. Create non-partitioned topic
pulsar-admin topics create persistent://my-first-tenant/my-first-namespace/my-first-topic
pulsar-admin namespaces grant-permission my-first-tenant/my-first-namespace --role testadmin --actions produce,consume
4. Create secret key
pulsar tokens create-secret-key --output /home/xxx/secret.key --base64
5. Generate token using secret key
pulsar tokens create --secret-key file:///home/xxx/secret.key --subject testadmin
Changes made to the broker.conf
• authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
• authorizationProvider=org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider
• brokerClientTlsEnabled=true #false
• brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken #
• brokerClientAuthenticationParameters={"token":"value of token"}
• tokenSecretKey=file:///home/ankita/Acrolinx/apache-pulsar-2.9.1/tokens/secret.key
• proxyRoles=testadmin
• superUserRoles=testadmin
Chnages made to proxy.conf
• authenticationEnabled=true
• authorizationEnabled=true
• authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
• tokenSecretKey=file:///path/to/secret.key
• superUserRoles=testadmin
• brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
• brokerClientAuthenticationParameters={"token":"value of token"}
• forwardAuthorizationCredentials=true
Changes made to Standalone.conf
• authenticationEnabled=true
• authorizationEnabled=true
• authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken
• tokenSecretKey=file:///path/to/secret.key
• superUserRoles=testadmin
• brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
• brokerClientAuthenticationParameters={"token":"value of token"}
Changes made to client.conf
• authPlugin=org.apache.pulsar.client.impl.auth.AuthenticationToken
• authParams=token:value of token
**Expected behavior**
I expect the client should not be able to produce or consume messages without token
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Desktop (please complete the following information):**
- OS: [Debian]
**Additional context**
Contributor guide
Research direction
Start with the standalone configuration and the AuthenticationProviderToken settings, then compare broker.conf, proxy.conf, and client.conf while reproducing the listed tenant, namespace, and topic commands. Done means an unauthenticated client is denied produce and consume access while the token-authenticated testadmin client retains its granted permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, authorization, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100