[cleanup][doc] Merge the broker and proxy authentication configuration by nodece · Pull Request #18343 · apache/pulsar

nodece · 2022-11-04T11:43:10Z

Motivation

Authentication documentation has too many duplicate configurations and some unnecessary configurations.

Documentation

doc
doc-required
doc-not-needed
doc-complete

Matching PR in forked repository

PR in forked repository:

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

site2/docs/security-basic-auth.md

momo-jun · 2022-11-14T01:49:41Z

site2/docs/security-athenz.md

-:::
-
-In the `conf/broker.conf` configuration file in your Pulsar installation, you need to provide the class name of the Athenz authentication provider as well as a comma-separated list of provider domain names.
+To configure brokers/proxies to authenticate clients using Authenz, add the following parameters to the `conf/broker.conf` and the `conf/proxy.conf` file. If you use a standalone Pulsar, you need to add these parameters to the `conf/standalone.conf` file, you need to provide the class name of the Athenz authentication provider as well as a comma-separated list of provider domain names.


Does provide the class name of the Athenz authentication provider as well as a comma-separated list of provider domain names also apply to broker.conf and proxy.conf? The proposed description seems it only applies to standalone.conf.

This can apply to broker/proxy/standalone.

momo-jun · 2022-11-14T01:52:23Z

site2/docs/security-overview.md

 :::note

-Starting from 2.11.0, [TLS authentication](security-tls-authentication.md) includes [TLS encryption](security-tls-transport.md) by default. If you configure TLS authentication first, then TLS encryption automatically applies; if you configure TLS encryption first, you can select any one of the above authentication providers.
+Starting from 2.11.0, if you can configure [Mutual TLS](security-tls-transport.md) with any one of the above authentication providers.


Suggested change

Starting from 2.11.0, if you can configure [Mutual TLS](security-tls-transport.md) with any one of the above authentication providers.

Starting from 2.11.0, you can configure [Mutual TLS](security-tls-transport.md) with any one of the above authentication providers.

Is this what you mean?

Good catch!

momo-jun · 2022-11-14T01:56:18Z

site2/docs/security-overview.md

-:::
+**Important:** If your authentication data contains an expiration time, or your authorization provider depends on the authentication data, you must to:
+
+1. Ensure your authentication data of proxies no expiration time, brokers don't support refreshing this authentication data.


Suggested change

1. Ensure your authentication data of proxies no expiration time, brokers don't support refreshing this authentication data.

1. Ensure your authentication data of proxies has no expiration time since brokers don't support refreshing this authentication data.

Is brokers don't support refreshing this authentication data the reason or something users need to ensure?

This is a reason.

momo-jun · 2022-11-14T01:56:37Z

site2/docs/security-overview.md

+When you use proxies between clients and brokers, there are two authentication data, one from proxies, one from clients, brokers only authenticate proxies (known as **self-authentication**) by default. To forward the authentication data from clients to brokers for client authentication (known as **original authentication**).

-:::
+**Important:** If your authentication data contains an expiration time, or your authorization provider depends on the authentication data, you must to:


Suggested change

**Important:** If your authentication data contains an expiration time, or your authorization provider depends on the authentication data, you must to:

**Important:** If your authentication data contains an expiration time, or your authorization provider depends on the authentication data, you must:

momo-jun · 2022-11-14T02:02:16Z

site2/docs/security-overview.md

-When you use proxies between clients and brokers, brokers only authenticate proxies (known as **self-authentication**) by default. To forward the authentication data from clients to brokers for client authentication (known as **original authentication**), you need to:
-1. Set `forwardAuthorizationCredentials` to `true` in the `conf/proxy.conf` file.
-2. Set `authenticateOriginalAuthData` to `true` in the `conf/broker.conf` file, which ensures that brokers recheck the client authentication.
+When you use proxies between clients and brokers, there are two authentication data, one from proxies, one from clients, brokers only authenticate proxies (known as **self-authentication**) by default. To forward the authentication data from clients to brokers for client authentication (known as **original authentication**).


Suggested change

When you use proxies between clients and brokers, there are two authentication data, one from proxies, one from clients, brokers only authenticate proxies (known as **self-authentication**) by default. To forward the authentication data from clients to brokers for client authentication (known as **original authentication**).

When you use proxies between clients and brokers, there are two authentication data:

* authentication data from proxies that brokers default to authenticate - known as **self-authentication**.

* authentication data from clients that proxies forward to brokers for authenticating - known as **original authentication**.

Is this what you mean?

authentication data from clients - known as original authentication.

To forward the authentication data from clients to brokers by the proxies (known as original authentication).

Updated the suggestion.

site2/docs/security-athenz.md

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

site2/docs/security-athenz.md

Co-authored-by: momo-jun <60642177+momo-jun@users.noreply.github.com>

momo-jun

LGTM.

This commit sets the locale to en-US in order to avoid ambiguous decimal formattings that can cause the CPUResourceTest to fail. This closes apache#18343.

[cleanup][doc] Merge the broker and proxy authentication configuration

9dcb32b

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

nodece requested review from RobertIndie and momo-jun November 4, 2022 11:44

github-actions bot added the doc Your PR contains doc changes, no matter whether the changes are in markdown or code files. label Nov 4, 2022

RobertIndie reviewed Nov 7, 2022

View reviewed changes

site2/docs/security-basic-auth.md Outdated Show resolved Hide resolved

site2/docs/security-basic-auth.md Show resolved Hide resolved

momo-jun reviewed Nov 14, 2022

View reviewed changes

site2/docs/security-athenz.md Outdated Show resolved Hide resolved

Fix review

5ebb160

Signed-off-by: Zixuan Liu <nodeces@gmail.com>

nodece requested review from RobertIndie and momo-jun November 14, 2022 08:21

RobertIndie approved these changes Nov 15, 2022

View reviewed changes

momo-jun reviewed Nov 15, 2022

View reviewed changes

site2/docs/security-athenz.md Outdated Show resolved Hide resolved

Update site2/docs/security-athenz.md

343bc6e

Co-authored-by: momo-jun <60642177+momo-jun@users.noreply.github.com>

nodece requested a review from momo-jun November 15, 2022 13:57

momo-jun approved these changes Nov 16, 2022

View reviewed changes

RobertIndie merged commit 23695a9 into apache:master Nov 16, 2022

	Starting from 2.11.0, if you can configure [Mutual TLS](security-tls-transport.md) with any one of the above authentication providers.
	Starting from 2.11.0, you can configure [Mutual TLS](security-tls-transport.md) with any one of the above authentication providers.

	1. Ensure your authentication data of proxies no expiration time, brokers don't support refreshing this authentication data.
	1. Ensure your authentication data of proxies has no expiration time since brokers don't support refreshing this authentication data.

	Important: If your authentication data contains an expiration time, or your authorization provider depends on the authentication data, you must to:
	Important: If your authentication data contains an expiration time, or your authorization provider depends on the authentication data, you must:

-When you use proxies between clients and brokers, there are two authentication data, one from proxies, one from clients, brokers only authenticate proxies (known as **self-authentication**) by default. To forward the authentication data from clients to brokers for client authentication (known as **original authentication**).
+When you use proxies between clients and brokers, there are two authentication data:
+* authentication data from proxies that brokers default to authenticate - known as **self-authentication**.
+* authentication data from clients that proxies forward to brokers for authenticating - known as **original authentication**.

Conversation

nodece commented Nov 4, 2022

Motivation

Documentation

Matching PR in forked repository

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

momo-jun Nov 14, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

momo-jun left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

momo-jun Nov 14, 2022 •

edited

Loading