[Bug] acl 2.0 system topic TBW102 and group CLIENT_INNER_PRODUCER need manual authorization when i use cluster proxy mode
- Dominant language
- Java
- Stars
- 22.6k
- Forks
- 12k
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 26
Description
### Before Creating the Bug Report
- [x] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq/discussions).
- [x] I have searched the [GitHub Issues](https://github.com/apache/rocketmq/issues) and [GitHub Discussions](https://github.com/apache/rocketmq/discussions) of this repository and believe that this is not a duplicate.
- [x] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.
### Runtime platform environment
linux
### RocketMQ version
rocketmq 5.3.3
### JDK Version
jdk 1.8
### Describe the Bug
use cluster pxoxy mode and set proxy enableAclRpcHookForClusterMode = true, create a normal user
producer and consumer use the normal user as accessKey and secretKey to send and consume message
but i found proxy log has some error, note that the normal user has no permisson to access system topic TBW102 and group CLIENT_INNER_PRODUCER
### Steps to Reproduce
use cluster pxoxy mode and set proxy enableAclRpcHookForClusterMode = true, create a normal user
producer and consumer use the normal user as accessKey and secretKey to send and consume message
but i found proxy log has some error, note that the normal user has no permisson to access system topic TBW102 and group CLIENT_INNER_PRODUCER
### What Did You Expect to See?
normal user has permisson to access system topic and group
### What Did You See Instead?
normal user don't have permisson to access system topic and group
### Additional Context
_No response_
Contributor guide
Research direction
Start by reproducing cluster proxy mode with enableAclRpcHookForClusterMode=true, using a normal user's accessKey and secretKey, and inspect the proxy ACL authorization path for TBW102 and CLIENT_INNER_PRODUCER. Done means normal producers and consumers can send and consume without authorization errors for these system resources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authorization, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100