apache / apache/pulsar

[Bug] Proxy does not forward credentials correctly for multi-staged authentication

Open
#19,291 1 comment 0 reactions 0 assignees View on GitHub
area/proxy Stale type/bug
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Version

Master (and presumably all others)

### Minimal reproduce step

Bug discovered while reviewing the code. Inspect the lifecycle of the [clientAuthData](https://github.com/apache/pulsar/blob/86205a9edfafb8710b24bdb0d2f1db84c5fc1926/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java#L100) variable. The variable is set to the last `authData` received by the client, which means that for multi-staged authentication, it is not possible to forward the authentication credentials.

### What did you expect to see?

I'd expect the protocol to either support forwarding these credentials or to fail when configured to do something it is unable to do correctly.

### What did you see instead?

Described above.

### Anything else?

For added context, I discussed this issue here: https://github.com/apache/pulsar/pull/18130#discussion_r1080838475.

### Are you willing to submit a PR?

- [X] I'm willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Start in pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java around the clientAuthData lifecycle, then read the linked discussion in PR 18130. Determine whether multi-stage credentials should be forwarded or the configuration should fail; done means the proxy no longer silently mishandles multi-stage authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.