Wrong tokenSecretKey configuration description about using base64 inline

[erobot]

Describe the bug
When using base64 line in tokenSecretKey, config should specify like "tokenSecretKey=data:;base64,xxxxxxxxx" but not "tokenSecretKey=data:base64,xxxxxxxxx". Description in documnet is missing a semicolon.

data URI scheme:
https://en.wikipedia.org/wiki/Data_URI_scheme

wrong documents:
https://pulsar.apache.org/docs/en/reference-configuration/

Configure the secret key to be used to validate auth tokens. The key can be specified like: tokenSecretKey=data:base64,xxxxxxxxx or tokenSecretKey=file:///my/secret.key

https://pulsar.apache.org/docs/en/security-jwt/

# If using secret key
tokenSecretKey=file:///path/to/secret.key
# The key can also be passed inline:
# tokenSecretKey=data:base64,FLFyW0oLJ2Fi22KKCm21J18mbAdztfSHN/lAT5ucEKU=

To Reproduce
// correct result
apache-pulsar-2.5.0>bin/pulsar tokens create --secret-key 'qcsXyb5eo8c09YXIMJaA97RYPCmIuyTlrN2KcI0zzxM=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.L869nKrziQIPkgqIawIh-RxxDelfGIiol1DBhoBl26Y

// wrong result
apache-pulsar-2.5.0>bin/pulsar tokens create --secret-key 'data:base64,qcsXyb5eo8c09YXIMJaA97RYPCmIuyTlrN2KcI0zzxM=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.ne2WjK3zY4cecotgUYkU0kkviOyslnCqPDHcPYF-HDc

// correct result
apache-pulsar-2.5.0>bin/pulsar tokens create --secret-key 'data:;base64,qcsXyb5eo8c09YXIMJaA97RYPCmIuyTlrN2KcI0zzxM=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.L869nKrziQIPkgqIawIh-RxxDelfGIiol1DBhoBl26Y

Expected behavior
Correct tokenSecretKey base64 inline description in documents and examples.

[jiazhai]

@erobot How to identify it is wrong/correct result?

[jiazhai]

Here is my reproduce:

➜  pulsar git:(master) ✗ bin/pulsar tokens create-secret-key --output  my-secret.key --base64 
➜  pulsar git:(master) ✗ cat my-secret.key 
5UeeNgpaylEiilQWt7v26l0HSI0/873wXx6tr8icrg0=%                                                                                                                                                                                                 ➜  pulsar git:(master) ✗ bin/pulsar tokens create --secret-key file:///Users/jia/ws/code/pulsar/my-secret.key --subject admin 
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.Yeh9_O8k_ymZnEWT9R_xiOrrNSmxJhfLE2nuvYMzzTw
➜  pulsar git:(master) ✗ 
➜  pulsar git:(master) ✗ bin/pulsar tokens create --secret-key 'data:base64,5UeeNgpaylEiilQWt7v26l0HSI0/873wXx6tr8icrg0=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.Yeh9_O8k_ymZnEWT9R_xiOrrNSmxJhfLE2nuvYMzzTw
➜  pulsar git:(master) ✗ bin/pulsar tokens create --secret-key 'data:;base64,5UeeNgpaylEiilQWt7v26l0HSI0/873wXx6tr8icrg0=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.oD2kZpw8Qn9IzehAL_WzTfVXohA_BIhwYXdpLFxoiNw

[erobot]

@erobot How to identify it is wrong/correct result?

I think secret key is the 128 bit binary data after base64 decoded. The base64 encoded string is the convenient representantion.

Then binary secret key in file should get the same result and the result same as this method is the correct result.

apache-pulsar-2.5.0>echo qcsXyb5eo8c09YXIMJaA97RYPCmIuyTlrN2KcI0zzxM= | base64 -d > secret.key
apache-pulsar-2.5.0>hexdump secret.key 
0000000 cba9 c917 5ebe c7a3 f534 c885 9630 f780
0000010 58b4 293c bb88 e524 ddac 708a 338d 13cf
0000020
apache-pulsar-2.5.0>bin/pulsar tokens create --secret-key file://path/to/secret.key --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.L869nKrziQIPkgqIawIh-RxxDelfGIiol1DBhoBl26Y
apache-pulsar-2.5.0>bin/pulsar tokens create --secret-key 'data:;base64,qcsXyb5eo8c09YXIMJaA97RYPCmIuyTlrN2KcI0zzxM=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.L869nKrziQIPkgqIawIh-RxxDelfGIiol1DBhoBl26Y

If base64 string itself is secret key, there is no need to mention base64.

// 'data:text' is same result as 'data:base64'
apache-pulsar-2.5.0>bin/pulsar tokens create --secret-key 'data:text,qcsXyb5eo8c09YXIMJaA97RYPCmIuyTlrN2KcI0zzxM=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.ne2WjK3zY4cecotgUYkU0kkviOyslnCqPDHcPYF-HDc
apache-pulsar-2.5.0>bin/pulsar tokens create --secret-key 'data:base64,qcsXyb5eo8c09YXIMJaA97RYPCmIuyTlrN2KcI0zzxM=' --subject admin
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.ne2WjK3zY4cecotgUYkU0kkviOyslnCqPDHcPYF-HDc

[jiazhai]

@erobot Thanks for the explanation. Looks you are right. Would you like to provide a fix for this?

[murong00]

My colleague also faced this confusion when using the base64 token secret key.