[Bug] Proxy does not forward credentials correctly for multi-staged authentication
- Dominant language
- Java
- Stars
- 15.3k
- Forks
- 3.8k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 160
Description
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
Master (and presumably all others)
### Minimal reproduce step
Bug discovered while reviewing the code. Inspect the lifecycle of the [clientAuthData](https://github.com/apache/pulsar/blob/86205a9edfafb8710b24bdb0d2f1db84c5fc1926/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java#L100) variable. The variable is set to the last `authData` received by the client, which means that for multi-staged authentication, it is not possible to forward the authentication credentials.
### What did you expect to see?
I'd expect the protocol to either support forwarding these credentials or to fail when configured to do something it is unable to do correctly.
### What did you see instead?
Described above.
### Anything else?
For added context, I discussed this issue here: https://github.com/apache/pulsar/pull/18130#discussion_r1080838475.
### Are you willing to submit a PR?
- [X] I'm willing to submit a PR!
Contributor guide
Research direction
Start in pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java around the clientAuthData lifecycle, then read the linked discussion in PR 18130. Determine whether multi-stage credentials should be forwarded or the configuration should fail; done means the proxy no longer silently mishandles multi-stage authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100