apache / apache/rocketmq

[Bug] acl 2.0 system topic TBW102 and group CLIENT_INNER_PRODUCER need manual authorization when i use cluster proxy mode

Open
#10,370 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
22.6k
Forks
12k
Avg merge
2d 20h
Merged PRs (30d)
26

Description

### Before Creating the Bug Report

- [x] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq/discussions).

- [x] I have searched the [GitHub Issues](https://github.com/apache/rocketmq/issues) and [GitHub Discussions](https://github.com/apache/rocketmq/discussions) of this repository and believe that this is not a duplicate.

- [x] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.

### Runtime platform environment

linux

### RocketMQ version

rocketmq 5.3.3

### JDK Version

jdk 1.8

### Describe the Bug

use cluster pxoxy mode and set proxy enableAclRpcHookForClusterMode = true, create a normal user
producer and consumer use the normal user as accessKey and secretKey to send and consume message
but i found proxy log has some error, note that the normal user has no permisson to access system topic TBW102 and group CLIENT_INNER_PRODUCER

### Steps to Reproduce

use cluster pxoxy mode and set proxy enableAclRpcHookForClusterMode = true, create a normal user
producer and consumer use the normal user as accessKey and secretKey to send and consume message
but i found proxy log has some error, note that the normal user has no permisson to access system topic TBW102 and group CLIENT_INNER_PRODUCER

### What Did You Expect to See?

normal user has permisson to access system topic and group

### What Did You See Instead?

normal user don't have permisson to access system topic and group

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing cluster proxy mode with enableAclRpcHookForClusterMode=true, using a normal user's accessKey and secretKey, and inspect the proxy ACL authorization path for TBW102 and CLIENT_INNER_PRODUCER. Done means normal producers and consumers can send and consume without authorization errors for these system resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.