[Bug] OAuth credentials flow fails when using oauth-authorization-server endpoint #19518
Closed
1 of 2 tasks
Labels
type/bug
The PR fixed a bug or issue reported a bug
Search before asking
Version
2.10.3
Minimal reproduce step
Use pulsar-perf to hit an OAuth2 provider with the AuthenticationOAuth2 plugin, like this:
bin/pulsar-perf produce -r 1000 --size 1024 --auth-plugin "org.apache.pulsar.client.impl.auth.oauth2.AuthenticationOAuth2" --auth-params '{"privateKey":"/pulsar/conf/creds.json","issuerUrl":"https://dev-42506116.okta.com/oauth2/aus3thh6rqs3FU45X697","scope":"pulsar_client_m2m","audience":"api://pulsarClient"}' --service-url pulsar://pulsar-proxy.pulsar.svc.cluster.local:6650/ persistent://public/default/test
with
/pulsar/conf/creds.json
containing contents (with actual credentials):{"client_id":"0oa7ypwv...d5d7","client_secret":"CL08ZNhF...7gLY01tF2bP","grant_type": "client_credentials"}
will reproduce the issue if the OAuth2 provider (Okta in this case) is configured with a metadata URI ending in
.well-known/oauth-authorization-server
instead of/.well-known/openid-configuration
What did you expect to see?
I need to be able to either provide the metadata URI as one of the auth-params in the client, or I need to be able to specify a different metadata resolver. It doesn't appear that the metadata resolver or this parameter are currently configurable.
See
pulsar/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationOAuth2.java
Line 67 in 04aa9e8
What did you see instead?
In DefaultMetadataResolver, the metadata URL is hard-coded:
(
pulsar/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/protocol/DefaultMetadataResolver.java
Line 107 in d111476
When the Pulsar client is using an OAuth provider with the endpoint
.well-known/oauth-authorization-server
, the implementation breaks and throws this exception:Anything else?
No response
Are you willing to submit a PR?
The text was updated successfully, but these errors were encountered: