Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[fix][broker] Continue using the next provider for authentication if one fails #23797

Merged
merged 1 commit into from
Jan 2, 2025

Conversation

nodece
Copy link
Member

@nodece nodece commented Dec 31, 2024

Motivation

When using Pulsar admin version 2.10.x with JWT authentication and a broker running 3.0.x (forked from Apache Pulsar) configured with both Kerberos and JWT authentication providers.

When a request is without the authentication method name, the broker iterates through each authentication provider to authenticate the request, if authentication data is valid, the broker acts on the request. In this scenario, I ensured that the JWT provider was configured correctly and the token was valid. However, I still encountered an authentication error.

The root cause is that the AuthenticationProviderList only catches the AuthenticationException exception, If an authentication provider throws an exception of a different type, the authentication process will be terminated.

Modifications

  • AuthenticationProviderList catches the Exception exception, and then uses the AuthenticationException to wrap the original exception.

Documentation

  • doc
  • doc-required
  • doc-not-needed
  • doc-complete

…one fails

Signed-off-by: Zixuan Liu <nodeces@gmail.com>
@github-actions github-actions bot added the doc-not-needed Your PR changes do not impact docs label Dec 31, 2024
@nodece nodece self-assigned this Dec 31, 2024
@dao-jun dao-jun closed this Dec 31, 2024
@dao-jun dao-jun reopened this Dec 31, 2024
@nodece
Copy link
Member Author

nodece commented Dec 31, 2024

/pulsarbot rerun-failure-checks

@codecov-commenter
Copy link

codecov-commenter commented Dec 31, 2024

Codecov Report

Attention: Patch coverage is 0% with 18 lines in your changes missing coverage. Please review.

Project coverage is 39.38%. Comparing base (bbc6224) to head (36e45cc).
Report is 821 commits behind head on master.

Files with missing lines Patch % Lines
...ker/authentication/AuthenticationProviderList.java 0.00% 18 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@              Coverage Diff              @@
##             master   #23797       +/-   ##
=============================================
- Coverage     73.57%   39.38%   -34.20%     
+ Complexity    32624    13104    -19520     
=============================================
  Files          1877     1796       -81     
  Lines        139502   139415       -87     
  Branches      15299    15822      +523     
=============================================
- Hits         102638    54906    -47732     
- Misses        28908    77315    +48407     
+ Partials       7956     7194      -762     
Flag Coverage Δ
inttests 26.70% <0.00%> (+2.11%) ⬆️
systests 23.24% <0.00%> (-1.09%) ⬇️
unittests 35.70% <0.00%> (-37.14%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
...ker/authentication/AuthenticationProviderList.java 0.00% <0.00%> (-48.67%) ⬇️

... and 1657 files with indirect coverage changes

@liudezhi2098
Copy link
Contributor

/pulsarbot rerun-failure-checks

@nodece nodece merged commit 7619e2f into apache:master Jan 2, 2025
104 of 113 checks passed
@nodece nodece deleted the fix-AuthenticationProviderList branch January 2, 2025 07:14
nodece added a commit that referenced this pull request Jan 2, 2025
…one fails (#23797)

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

(cherry picked from commit 7619e2f)
Signed-off-by: Zixuan Liu <nodeces@gmail.com>
nodece added a commit that referenced this pull request Jan 2, 2025
…one fails (#23797)

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

(cherry picked from commit 7619e2f)
Signed-off-by: Zixuan Liu <nodeces@gmail.com>
nodece added a commit that referenced this pull request Jan 2, 2025
…one fails (#23797)

Signed-off-by: Zixuan Liu <nodeces@gmail.com>
(cherry picked from commit 7619e2f)
@nodece nodece added this to the 4.1.0 milestone Jan 2, 2025
nikhil-ctds pushed a commit to datastax/pulsar that referenced this pull request Jan 3, 2025
…one fails (apache#23797)

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

(cherry picked from commit 7619e2f)
Signed-off-by: Zixuan Liu <nodeces@gmail.com>
(cherry picked from commit 62170e7)
srinath-ctds pushed a commit to datastax/pulsar that referenced this pull request Jan 3, 2025
…one fails (apache#23797)

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

(cherry picked from commit 7619e2f)
Signed-off-by: Zixuan Liu <nodeces@gmail.com>
(cherry picked from commit 62170e7)
@nodece
Copy link
Member Author

nodece commented Jan 13, 2025

This PR only fixes pulsar chain authentication, not HTTP authentication. The HTTP authentication has some issues, please see #23842.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants