-
Notifications
You must be signed in to change notification settings - Fork 3.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Authorization] Support GET_METADATA topic op after enable auth #12656
[Authorization] Support GET_METADATA topic op after enable auth #12656
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@yuruguo Could you please help add a test? The change looks good to me.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@michaeljmarshall please take a look as you are working on this topic during these days
Okay :) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. My one additional thought is that the added test is more complex than necessary, and that complexity will increase the time required to run this pretty simple test. I think there is a test Authentication Provider that would make it easier to test authorization without needing to explicitly test authentication, but I could be wrong.
* up/master: [Doc] Add explanations for setting geo-replication at topic level (apache#12633) commit chapter Tiered Storage (apache#12592) [pulsar-admin] Add remove-subscription-types-enabled command for namespace (apache#12392) Enable CLI to publish non-batched messages (apache#12641) [Doc] Add doc for tokenSettingPrefix (apache#12662) [pulsar-admin] Add corresponding get command for namespace (apache#12322) [pulsar-admin] Perfect judgment conditions of pulsar-admin (apache#12315) [broker] Avoid unnecessary recalculation of maxSubscriptionsPerTopic in AbstractTopic (apache#12658) [Transaction]Stop TB recovering with exception (apache#12636) [website][upgrade]feat: docs migration - 2.7.1 / client (apache#12612) [website][upgrade]feat: docs migration - 2.7.1 / performance (apache#12611) [website][upgrade]feat: docs migration - 2.7.1 / security (apache#12610) [Modernizer] Apply Modernizer plugin for pulsar broker common module and fix violation. (apache#12657) [Authorization] Support GET_METADATA topic op after enable auth (apache#12656) Fix StringIndexOutOfBoundsException in org.apache.pulsar.broker.resources.NamespaceResources#pathIsFromNamespace (apache#12659)
* up/master: [Doc] Add explanations for setting geo-replication at topic level (apache#12633) commit chapter Tiered Storage (apache#12592) [pulsar-admin] Add remove-subscription-types-enabled command for namespace (apache#12392) Enable CLI to publish non-batched messages (apache#12641) [Doc] Add doc for tokenSettingPrefix (apache#12662) [pulsar-admin] Add corresponding get command for namespace (apache#12322) [pulsar-admin] Perfect judgment conditions of pulsar-admin (apache#12315) [broker] Avoid unnecessary recalculation of maxSubscriptionsPerTopic in AbstractTopic (apache#12658) [Transaction]Stop TB recovering with exception (apache#12636) [website][upgrade]feat: docs migration - 2.7.1 / client (apache#12612) [website][upgrade]feat: docs migration - 2.7.1 / performance (apache#12611) [website][upgrade]feat: docs migration - 2.7.1 / security (apache#12610) [Modernizer] Apply Modernizer plugin for pulsar broker common module and fix violation. (apache#12657) [Authorization] Support GET_METADATA topic op after enable auth (apache#12656) Fix StringIndexOutOfBoundsException in org.apache.pulsar.broker.resources.NamespaceResources#pathIsFromNamespace (apache#12659) # Conflicts: # site2/website-next/versioned_sidebars/version-2.7.2-sidebars.json
### Motivation Currently, we can get the internal stats of a topic through `bin/pulsar-admin topics stats-internal tn1/ns1/tp1` and also get ledger metadata by specifying flag `--metadata`. However I found that `PulsarAuthorizationProvider` lacks support for topic operation `GET_METADATA` when verifying the role's authorization, code as below: https://github.com/apache/pulsar/blob/08a49c06bff4a52d26319a114961aed6cb6c4791/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/PersistentTopicsBase.java#L1162-L1164 https://github.com/apache/pulsar/blob/08a49c06bff4a52d26319a114961aed6cb6c4791/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java#L567-L596 The purpose of this PR is to support role with `lookup` topic authorization to `GET_METADATA` of ledger. (cherry picked from commit e476735)
### Motivation Currently, we can get the internal stats of a topic through `bin/pulsar-admin topics stats-internal tn1/ns1/tp1` and also get ledger metadata by specifying flag `--metadata`. However I found that `PulsarAuthorizationProvider` lacks support for topic operation `GET_METADATA` when verifying the role's authorization, code as below: https://github.com/apache/pulsar/blob/08a49c06bff4a52d26319a114961aed6cb6c4791/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/PersistentTopicsBase.java#L1162-L1164 https://github.com/apache/pulsar/blob/08a49c06bff4a52d26319a114961aed6cb6c4791/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java#L567-L596 The purpose of this PR is to support role with `lookup` topic authorization to `GET_METADATA` of ledger. (cherry picked from commit e476735)
…he#12656) ### Motivation Currently, we can get the internal stats of a topic through `bin/pulsar-admin topics stats-internal tn1/ns1/tp1` and also get ledger metadata by specifying flag `--metadata`. However I found that `PulsarAuthorizationProvider` lacks support for topic operation `GET_METADATA` when verifying the role's authorization, code as below: https://github.com/apache/pulsar/blob/08a49c06bff4a52d26319a114961aed6cb6c4791/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/PersistentTopicsBase.java#L1162-L1164 https://github.com/apache/pulsar/blob/08a49c06bff4a52d26319a114961aed6cb6c4791/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java#L567-L596 The purpose of this PR is to support role with `lookup` topic authorization to `GET_METADATA` of ledger.
Motivation
Currently, we can get the internal stats of a topic through
bin/pulsar-admin topics stats-internal tn1/ns1/tp1
and also get ledger metadata by specifying flag--metadata
.However I found that
PulsarAuthorizationProvider
lacks support for topic operationGET_METADATA
when verifying the role's authorization, code as below:pulsar/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/PersistentTopicsBase.java
Lines 1162 to 1164 in 08a49c0
pulsar/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java
Lines 567 to 596 in 08a49c0
The purpose of this PR is to support role with
lookup
topic authorization toGET_METADATA
of ledger.Documentation
no-need-doc