5.1.0 版本开启了acl，但是客户端错误账号也可以访问

[bugCats]

Before Creating the Bug Report

• I found a bug, not just asking a question, which should be created in GitHub Discussions.

• I have searched the GitHub Issues and GitHub Discussions of this repository and believe that this is not a duplicate.

• I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.

Runtime platform environment

Linux centos7 version 3.10.0-514.6.2.el7.x86_64

RocketMQ version

5.1.0

JDK Version

1.8.0_11

Describe the Bug

rocketMQ服务端启用了acl，但是客户端即便使用错误的账号也可以发布、接收消息

Steps to Reproduce

1. rocketMQ，部署在Linux服务器上，单组节点单副本Local模式部署
2. 启用acl：conf/broker.conf文件，增加：aclEnable = true
3. 客户端使用 rocketmq-client-java.5.0.5.jar

broker启动日志：
2023-05-17 10:49:59 INFO main - transactionOpBatchInterval=3000
2023-05-17 10:49:59 INFO main - aclEnable=true
2023-05-17 10:49:59 INFO main - storeReplyMessageEnable=true
..........
2023-05-17 10:50:00 INFO main - Broker plain acl conf data is : {"dataVersion":[{"counter":5,"timestamp":1684290520350}],"accounts":[{"accessKey":"RocketMQ","secretKey":12345678,"admin":false,"defaultTopicPerm":"DENY","defaultGroupPerm":"SUB","topicPerms":["topicA=DENY","topicB=PUB|SUB","topicC=SUB"],"groupPerms":["groupA=DENY","groupB=PUB|SUB","groupC=SUB"]},{"accessKey":"bugCatsadmin","secretKey":"12345678","admin":true},{"accessKey":"rocketmq2","secretKey":"12345678","admin":true}]}
2023-05-17 10:50:00 INFO main - The default acl dir /usr/local/rocketmq/rocketmq-5.1.0/conf/acl is not exist
2023-05-17 10:50:00 INFO main - Try to start service thread:AclFileWatchService started:false lastThread:null
2023-05-17 10:50:00 INFO main - Succeed to start AclFileWatchService
2023-05-17 10:50:00 INFO AclFileWatchService - AclFileWatchService service started
.......

在自己电脑，访问部署在公网上的rocketMq服务端，采用rocketmq-client-java.5.0.5.jar包中的示例代码：org.apache.rocketmq.client.java.example.PushConsumerExample。无论使用什么账号密钥，都可以正常发布、接收消息。

当客户端连接上时日志：
2023-05-17 10:53:05 INFO GrpcClientManagerThreadPool-0 - new consumer connected, group: tmcGroup CONSUME_PASSIVELY CLUSTERING channel: ClientChannelInfo [channel=GrpcClientChannel{clientId=bugcat@16088@0@566ixygv0z, remoteAddress=171.113.110.88:39414, localAddress=172.17.11.27:15891}, clientId=bugcat@16088@0@566ixygv0z, language=JAVA, version=433, lastUpdateTimestamp=1684291985413]

What Did You Expect to See?

只有正常账号密钥才能访问rocketmq服务端

What Did You See Instead?

无论使用什么账号密钥，都可以正常发布、接收消息

Additional Context

No response

[echooymxq]

Proxy启用了ACL了？

[bugCats]

Proxy启用了ACL了？

能告诉一下如何设置吗？
我在 broker.conf文件中增加enableACL = true，以及在启动broker自定义配置文件中添加 "enableACL": true，都没有生效。

[drpmma]

The default acl dir /usr/local/rocketmq/rocketmq-5.1.0/conf/acl is not exist

It appears that the ACL file failed to load successfully.

[drpmma]

And you should enable acl in ProxyConfig

private boolean enableACL = false;

[drpmma]

And you should enable acl in ProxyConfig

private boolean enableACL = false;

[bugCats]

The default acl dir

我在conf目录下创建了acl文件夹，并且复制了一份plain_acl.yml文件放入conf/acl目录中，然后重启了broker，依然不生效。
.
.
├── acl
│ └── plain_acl.yml
├── broker.conf
├── plain_acl.yml
├── rmq-proxy.json
.
.

启动日志：
023-05-17 15:17:53 INFO main - Looking for a resource file of name [META-INF/service/org.apache.rocketmq.acl.AccessValidator] ...
2023-05-17 15:17:53 WARN main - No resource file with name [META-INF/service/org.apache.rocketmq.acl.AccessValidator] found.
2023-05-17 15:17:53 INFO main - ServiceProvider loaded no AccessValidator, using default org.apache.rocketmq.acl.plain.PlainAccessValidator
2023-05-17 15:17:53 INFO main - Broker plain acl conf data is : {"dataVersion":[{"counter":5,"timestamp":1684290520350}],"accounts":[{"accessKey":"RocketMQ","secretKey":12345678,"admin":false,"defaultTopicPerm":"DENY","defaultGroupPerm":"SUB","topicPerms":["topicA=DENY","topicB=PUB|SUB","topicC=SUB"],"groupPerms":["groupA=DENY","groupB=PUB|SUB","groupC=SUB"]},{"accessKey":"bugCatsadmin","secretKey":"12345678","admin":true},{"accessKey":"rocketmq2","secretKey":"12345678","admin":true}]}
2023-05-17 15:17:53 INFO main - Broker plain acl conf data is : {"dataVersion":[{"counter":5,"timestamp":1684290520350}],"accounts":[{"accessKey":"RocketMQ","secretKey":12345678,"admin":false,"defaultTopicPerm":"DENY","defaultGroupPerm":"SUB","topicPerms":["topicA=DENY","topicB=PUB|SUB","topicC=SUB"],"groupPerms":["groupA=DENY","groupB=PUB|SUB","groupC=SUB"]},{"accessKey":"bugCatsadmin","secretKey":"12345678","admin":true},{"accessKey":"rocketmq2","secretKey":"12345678","admin":true}]}
2023-05-17 15:17:53 WARN main - The accessKey RocketMQ is repeated in multiple ACL files
2023-05-17 15:17:53 WARN main - The accessKey bugCatsadmin is repeated in multiple ACL files
2023-05-17 15:17:53 WARN main - The accessKey rocketmq2 is repeated in multiple ACL files
2023-05-17 15:17:53 INFO main - Try to start service thread:AclFileWatchService started:false lastThread:null
2023-05-17 15:17:53 INFO main - Succeed to start AclFileWatchService
2023-05-17 15:17:53 INFO AclFileWatchService - AclFileWatchService service started

我修改过broker.conf、rmq-proxy.json、以及自定义配置文件，都没有生效。
自定义配置：
{
"grpcServerPort": 15891, /* proxy 端口，15891~15899 /
"enableACL": true,
"enableTopicMessageTypeCheck": true / 开启主题和消息类型验证 */
}

同样在org.apache.rocketmq.proxy.config.ProxyConfig中的grpcServerPort生效了（我的proxy访问端口变成了15891），但是客户端仍然无需账号可以访问。

[Oliverwqcwrw]

Hello @bugCats ,
It was fixed by #6186

try 5.1.1

[MmringZee]

想问一下这个bug真的解决了吗？为什么我用5.1.2版本也依旧无效？ @bugCats

[bugCats]

想问一下这个bug真的解决了吗？为什么我用5.1.2版本也依旧无效？ @bugCats

升级有用，估计是你参数配置有问题。broker.conf、自定义的proxy.json都要设置。

[MmringZee]

想问一下你测试过使用的是conf/plain_acl.yml还是conf/acl/plain_acl.yml吗？
我之前在4.9.8的版本里发现使用mqadmin updateAclConfig 会更改conf/plain_acl.yml里的内容，并不会更改conf/acl/plain_acl.yml的内容，但如果没有创建acl目录broker.log日志又会一直刷屏acl不存在，挺无语的