[server] Add authorization to Replication Control RPCs (notifyLeaderAndIsr, updateMetadata, stopReplica, adjustIsr)

[vaibhavk1992]

Summary

Implements authorization checks for internal replication control RPC operations as part of issue #3249.

These are server-to-server RPCs used by the CoordinatorServer to manage replication state across TabletServers. Currently, these critical operations have no authorization checks, allowing any client to potentially call internal cluster management APIs.

Changes

Authorization Added to 4 Internal RPCs:

Method	Location	Authorization	Resource
notifyLeaderAndIsr	TabletService	CLUSTER/WRITE	cluster()
updateMetadata	TabletService	CLUSTER/WRITE	cluster()
stopReplica	TabletService	CLUSTER/WRITE	cluster()
adjustIsr	CoordinatorService	CLUSTER/WRITE	cluster()

Implementation Pattern:

if (authorizer != null) {
    authorizer.authorize(currentSession(), WRITE, Resource.cluster());
}

Files Modified:

1. TabletService.java

   • Added authorization to: notifyLeaderAndIsr, updateMetadata, stopReplica

2. CoordinatorService.java

   • Added static import for OperationType.WRITE
   • Added authorization to: adjustIsr

3. FlussAuthorizationITCase.java

   • Added test method: testInternalReplicationControlAuthorization
   • Added imports for: NotifyLeaderAndIsrRequest, UpdateMetadataRequest, StopReplicaRequest, AdjustIsrRequest

Key Design Decisions

1. CLUSTER/WRITE Permission: These operations modify cluster replication state, consistent with other cluster control operations like rebalance() and cancelRebalance()

2. Internal Session Bypass: The AbstractAuthorizer.isAuthorized() method automatically allows session.isInternal() requests, so internal server-to-server calls continue working seamlessly

3. No Explicit isInternal() Check: No need to add explicit checks - the authorization framework handles it automatically

4. External Client Protection: External clients attempting to call these internal RPCs will now receive AuthorizationException

Test Coverage

The new test testInternalReplicationControlAuthorization() verifies:

✅ External clients blocked: All 4 methods throw AuthorizationException when called by external clients without CLUSTER/WRITE permission
✅ Internal sessions bypass: Internal server-to-server calls do NOT throw AuthorizationException (they may fail for other reasons like invalid data, but not authorization)
✅ Proper error messages: Authorization failures include the correct principal, operation type (WRITE), and resource (CLUSTER)

Security Impact

Before: External clients could call internal replication control RPCs ❌
After: Only internal servers or authorized clients with CLUSTER/WRITE permission can call these RPCs ✅

Backward Compatibility

• ✅ Existing clusters with authorization disabled continue working unchanged
• ✅ Internal server-to-server replication continues working (bypasses authorization)
• ✅ Minimal code changes - only adding authorization checks, no logic changes

Related Issue

Closes #3249

[wuchong]

Hi @vaibhavk1992,

I reviewed the pull request and identified that the failure is caused by the newly introduced test method testInternalReplicationControlAuthorization. I reproduced the same exception locally, and the issue resolves when this method is removed.

The root cause is that testInternalReplicationControlAuthorization sends an updateMetadata request with empty metadata to a TabletServer. Although the RPC succeeds due to proper client permissions, it corrupts the TabletServer's metadata, causing the server to fail. Consequently, subsequent tests, such as testTableExistsAuthorization, report NoneReplica errors.

[wuchong]

In addition, these RPCs are intended to be internal (used for intra-cluster communication) rather than public. The newly added validation allows clients with cluster() permissions to access them, which introduces potential security risks to the cluster. A better approach would be to restrict these RPCs to internal sessions only, returning an error for any non-internal sessions.

[vaibhavk1992]

Hi @wuchong
Thanks for the review and feedback.
Do we know why when I try to run the test manually they pass but on github CL it is failing. Also When I run an tests for individual module like core the it runs forever. It becomes a bit difficult to test the changes every time on CL. Do we need to set any special config in local to run all the test before I commit? I am using java 11 to build and run test cases but not able to reproduce the same error on local.

[vaibhavk1992]

@wuchong Please review, I have fixed the test case.