You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug:
Hi, I think that I found a little bug in mop authorization module.
Pulsar version: 3.0.5
MoP version: 3.0.5.8
Configuration: in mop, when I set the authorization switch on ( mqttAuthorizationEnabled=true ), sending topic more than three levels, like persistent://public/default/a/b, persistent://public/default/a/b/c, always receives unauthorized error. If
wanna reproduce this issue, do not use superuser token.
Solution:
I think the problem is in MQTTBrokerProtocolMethodProcessor, and I tried to fix it, it seems worked.
I paste the code that I fixed below, I think it is a wrong way to directly call TopicName.get(msg.variableHeader().topicName()) etc. The mqtt topic name is seperated by /, we need to transfer mqtt topic name to pulsar topic name, thus url encode is needed.
processSubscribe method:
Precondition, persistent://public/default/%2F%23 (mqtt wildcard pattern is persistent://public/default/#) persistent://public/default/a%2F%23 (mqtt wildcard pattern is persistent://public/default/a/#) etc. These topics can not exist, or it will cause authorization leak problems.
I use this trick to do namespace level authorization when using mqtt wildcard, but tenant admins still receives an unauthorized error(there's no code to deal with tenant admins). In my scenario, mqtt topic names are generated by my application, authorization leak problems will not occur. Hopes the codes can be further optimized by refactoring the authorization module.
for (MqttTopicSubscriptiontopic: msg.payload().topicSubscriptions()) {
finalStringpulsarTopicName = PulsarTopicUtils.getEncodedPulsarTopicName(topic.topicName(),
configuration.getDefaultTenant(), configuration.getDefaultNamespace(),
TopicDomain.getEnum(configuration.getDefaultTopicDomain()));
authorizationFutures.add(this.authorizationService.canConsumeAsync(TopicName.get(pulsarTopicName),
userRole, connection.getAuthData(), userRole).thenAccept((authorized) -> {
if (!authorized) {
authorizedFlag.set(false);
log.warn("[Subscribe] no authorization to sub topic={}, userRole={}, CId= {}",
topic.topicName(), userRole, clientId);
}
}));
}
The text was updated successfully, but these errors were encountered:
Describe the bug:
Hi, I think that I found a little bug in mop authorization module.
Pulsar version: 3.0.5
MoP version: 3.0.5.8
Configuration: in mop, when I set the authorization switch on ( mqttAuthorizationEnabled=true ), sending topic more than three levels, like
persistent://public/default/a/b
,persistent://public/default/a/b/c
, always receives unauthorized error. Ifwanna reproduce this issue, do not use superuser token.
Solution:
I think the problem is in MQTTBrokerProtocolMethodProcessor, and I tried to fix it, it seems worked.
I paste the code that I fixed below, I think it is a wrong way to directly call TopicName.get(msg.variableHeader().topicName()) etc. The mqtt topic name is seperated by /, we need to transfer mqtt topic name to pulsar topic name, thus url encode is needed.
Precondition, persistent://public/default/%2F%23 (mqtt wildcard pattern is persistent://public/default/#) persistent://public/default/a%2F%23 (mqtt wildcard pattern is persistent://public/default/a/#) etc. These topics can not exist, or it will cause authorization leak problems.
I use this trick to do namespace level authorization when using mqtt wildcard, but tenant admins still receives an unauthorized error(there's no code to deal with tenant admins). In my scenario, mqtt topic names are generated by my application, authorization leak problems will not occur. Hopes the codes can be further optimized by refactoring the authorization module.
The text was updated successfully, but these errors were encountered: