apache / apache/pulsar

[Doc] Incomplete info re authenticationRefreshCheckSeconds

Open
#22,124 6 comments 0 reactions 0 assignees View on GitHub
doc-required
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### What issue do you find in Pulsar docs?

In the blurb:

https://pulsar.apache.org/docs/next/security-overview/#how-authentication-works-in-pulsar

, it only talks about the need for clients to implement a refresh. I was surprised to learn that the pulsar broker does not support `authenticationRefreshCheckSeconds` for mTLS - and I feel that auth mechanisms that actually support this server (and client) side should be explicitly called out.

At the same time, I will create tickets to track mTLS support for `authenticationRefreshCheckSeconds`.

### What is your suggestion?

Perhaps provide a table, listing all the auth plugins, and their support for authenticationRefreshCheckSeconds. This can be Yes, no or n/a

Or provide some info or how a dev can figure this out. For me, I looked at the broker code, and saw that the [AuthenticationProviderTls](https://github.com/apache/pulsar/blob/bbc62245c5ddba1de4b1e7cee4ab49334bc36277/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderTls.java) class did not define / create an AuthenticationState instance (as compared to the [token provider](https://github.com/apache/pulsar/blob/bbc62245c5ddba1de4b1e7cee4ab49334bc36277/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java))

### Any reference?

_No response_

### Are you willing to submit a PR?

- [X] I'm willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Start with the security overview section on how authentication works in Pulsar, then compare AuthenticationProviderTls.java with AuthenticationProviderToken.java and inspect the other authentication plugins. Document which mechanisms support authenticationRefreshCheckSeconds on the broker and client, using Yes, No, or N/A, and explain how developers can determine support.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, backend, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.