apache / apache/pulsar

Configuring brokerClientAuthenticationParameter for AuthenticationToken plugin does not work as documented

Open
#14,435 4 comments 0 reactions 0 assignees View on GitHub
help wanted lifecycle/stale Stale type/bug
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

**Describe the bug**
The documentation suggest that the proper way to reference a file with `brokerClientAuthenticationParameter` for JWT plugin is `brokerClientAuthenticationParameters={"file":"///path/to/proxy-token.txt"}`, which does not work. When you [look at the source](https://github.com/apache/pulsar/blob/v2.9.1/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationToken.java#L79) you'll see that it parses a string like `file:/some/path` or `token:someToken`, otherwise it tried JSON which explicitly only looks for the `token` property. Runtime behavior confirms this, I get a long long stack trace pointing back to trying to look at the `token` property of the provided JSON. So either [the docs](https://pulsar.apache.org/docs/en/2.8.2/security-jwt/#enable-token-authentication-on-brokers) are wrong or the code is wrong.

**To Reproduce**
Steps to reproduce the behavior:
1. Setup [Client authentication using tokens based on JSON Web Tokens]
2. Instead of embeddeding the token directly into the config uncomment and use the alternative to load from a file below, which reads: `brokerClientAuthenticationParameters={"file":"///path/to/proxy-token.txt"}`

**Expected behavior**
The provided JSON parameter works as stated in the documentation, OR the documentation instead recommends the non-JSON parameters.

**Screenshots**
N/A

**Desktop (please complete the following information):**
- Ubuntu 20.04, but this is running in the official container.

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Start with AuthenticationToken.java at the linked source location and the security-jwt documentation section; compare the accepted brokerClientAuthenticationParameters formats with the documented JSON file form. Reproduce the configuration from the listed steps, then align the implementation or documentation so the expected token-file configuration is correct and verify token authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.