Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[branch-2.10][fix][proxy] Move status endpoint out of auth coverage #21494

Merged
merged 4 commits into from
Nov 1, 2023
Merged

[branch-2.10][fix][proxy] Move status endpoint out of auth coverage #21494

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
77c7e1a
Cherry-pick
mattisonchao Nov 1, 2023
b89495f
Fix error
mattisonchao Nov 1, 2023
3258339
Fix test
mattisonchao Nov 1, 2023
90e4d57
Fix test
mattisonchao Nov 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyServiceStarter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,11 +241,13 @@ public static void addWebServerHandlers(WebServer server,
ProxyConfiguration config,
ProxyService service,
BrokerDiscoveryProvider discoveryProvider) throws Exception {
// We can make 'status.html' publicly accessible without authentication since
// it does not contain any sensitive data.
server.addRestResource("/", VipStatus.ATTRIBUTE_STATUS_FILE_PATH, config.getStatusFilePath(),
VipStatus.class, false);
if (config.isEnableProxyStatsEndpoints()) {
server.addRestResources("/", VipStatus.class.getPackage().getName(),
VipStatus.ATTRIBUTE_STATUS_FILE_PATH, config.getStatusFilePath());
server.addRestResources("/proxy-stats", ProxyStats.class.getPackage().getName(),
ProxyStats.ATTRIBUTE_PULSAR_PROXY_NAME, service);
server.addRestResource("/proxy-stats", ProxyStats.ATTRIBUTE_PULSAR_PROXY_NAME, service,
ProxyStats.class);
if (service != null) {
PrometheusMetricsServlet metricsServlet = service.getMetricsServlet();
if (metricsServlet != null) {
Expand Down
31 changes: 28 additions & 3 deletions pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/WebServer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,15 +185,40 @@ private void addServlet(String basePath, ServletHolder servletHolder,
handlers.add(context);
}

public void addRestResources(String basePath, String javaPackages, String attribute, Object attributeValue) {
/**
* Add a REST resource to the servlet context with authentication coverage.
*
* @see WebServer#addRestResource(String, String, Object, Class, boolean)
*
* @param basePath The base path for the resource.
* @param attribute An attribute associated with the resource.
* @param attributeValue The value of the attribute.
* @param resourceClass The class representing the resource.
*/
public void addRestResource(String basePath, String attribute, Object attributeValue, Class<?> resourceClass) {
addRestResource(basePath, attribute, attributeValue, resourceClass, true);
}

/**
* Add a REST resource to the servlet context.
*
* @param basePath The base path for the resource.
* @param attribute An attribute associated with the resource.
* @param attributeValue The value of the attribute.
* @param resourceClass The class representing the resource.
* @param requireAuthentication A boolean indicating whether authentication is required for this resource.
*/
public void addRestResource(String basePath, String attribute, Object attributeValue,
Class<?> resourceClass, boolean requireAuthentication) {
ResourceConfig config = new ResourceConfig();
config.packages("jersey.config.server.provider.packages", javaPackages);
config.register(resourceClass);
config.register(JsonMapperProvider.class);
ServletHolder servletHolder = new ServletHolder(new ServletContainer(config));
servletHolder.setAsyncSupported(true);
// This method has not historically checked for existing paths, so we don't check here either. The
// method call is added to reduce code duplication.
addServlet(basePath, servletHolder, Collections.singletonList(Pair.of(attribute, attributeValue)), true, false);
addServlet(basePath, servletHolder, Collections.singletonList(Pair.of(attribute, attributeValue)),
requireAuthentication, false);
}

public int getExternalServicePort() {
Expand Down
44 changes: 40 additions & 4 deletions pulsar-proxy/src/test/java/org/apache/pulsar/proxy/server/ProxyWithJwtAuthorizationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@
import static org.mockito.Mockito.spy;

import com.google.common.collect.Sets;

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import java.util.Base64;
Expand All @@ -31,26 +30,39 @@
import java.util.Set;
import java.util.concurrent.TimeUnit;
import javax.crypto.SecretKey;
import lombok.Cleanup;
import org.apache.pulsar.broker.authentication.AuthenticationProviderToken;
import org.apache.pulsar.broker.authentication.AuthenticationService;
import org.apache.pulsar.broker.authentication.utils.AuthTokenUtils;
import org.apache.pulsar.broker.resources.PulsarResources;
import org.apache.pulsar.client.admin.PulsarAdmin;
import org.apache.pulsar.client.api.*;
import org.apache.pulsar.client.api.AuthenticationFactory;
import org.apache.pulsar.client.api.ClientBuilder;
import org.apache.pulsar.client.api.Consumer;
import org.apache.pulsar.client.api.Message;
import org.apache.pulsar.client.api.Producer;
import org.apache.pulsar.client.api.ProducerConsumerBase;
import org.apache.pulsar.client.api.PulsarClient;
import org.apache.pulsar.client.api.PulsarClientException;
import org.apache.pulsar.client.api.Schema;
import org.apache.pulsar.client.impl.auth.AuthenticationToken;
import org.apache.pulsar.common.configuration.PulsarConfigurationLoader;
import org.apache.pulsar.common.policies.data.AuthAction;
import org.apache.pulsar.common.policies.data.ClusterData;
import org.apache.pulsar.common.policies.data.SubscriptionAuthMode;
import org.apache.pulsar.common.policies.data.TenantInfoImpl;
import org.apache.pulsar.metadata.impl.ZKMetadataStore;
import org.glassfish.jersey.client.ClientConfig;
import org.glassfish.jersey.logging.LoggingFeature;
import org.mockito.Mockito;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;

import javax.crypto.SecretKey;
import javax.ws.rs.client.Client;
import javax.ws.rs.core.Response;

public class ProxyWithJwtAuthorizationTest extends ProducerConsumerBase {
private static final Logger log = LoggerFactory.getLogger(ProxyWithJwtAuthorizationTest.class);
Expand Down Expand Up @@ -111,6 +123,7 @@ protected void setup() throws Exception {
proxyConfig.setBrokerClientAuthenticationPlugin(AuthenticationToken.class.getName());
proxyConfig.setBrokerClientAuthenticationParameters(PROXY_TOKEN);
proxyConfig.setAuthenticationProviders(providers);
proxyConfig.setStatusFilePath("./src/test/resources/vip_status.html");

AuthenticationService authService =
new AuthenticationService(PulsarConfigurationLoader.convertFrom(proxyConfig));
Expand Down Expand Up @@ -397,6 +410,29 @@ public void testProxyAuthorizationWithPrefixSubscriptionAuthMode() throws Except
log.info("-- Exiting {} test --", methodName);
}

@Test
void testGetStatus() throws Exception {
log.info("-- Starting {} test --", methodName);
final PulsarResources resource = new PulsarResources(new ZKMetadataStore(mockZooKeeper),
new ZKMetadataStore(mockZooKeeperGlobal));
final AuthenticationService authService = new AuthenticationService(
PulsarConfigurationLoader.convertFrom(proxyConfig));
final WebServer webServer = new WebServer(proxyConfig, authService);
ProxyServiceStarter.addWebServerHandlers(webServer, proxyConfig, proxyService,
new BrokerDiscoveryProvider(proxyConfig, resource));
webServer.start();
@Cleanup
final Client client = javax.ws.rs.client.ClientBuilder
.newClient(new ClientConfig().register(LoggingFeature.class));
try {
final Response r = client.target(webServer.getServiceUri()).path("/status.html").request().get();
Assert.assertEquals(r.getStatus(), Response.Status.OK.getStatusCode());
} finally {
webServer.stop();
}
log.info("-- Exiting {} test --", methodName);
}

private void createAdminClient() throws Exception {
admin = spy(PulsarAdmin.builder().serviceHttpUrl(webServer.getServiceUri().toString())
.authentication(AuthenticationFactory.token(ADMIN_TOKEN)).build());
Expand Down
4 changes: 2 additions & 2 deletions pulsar-proxy/src/test/java/org/apache/pulsar/proxy/server/UnauthedAdminProxyHandlerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,8 +86,8 @@ protected void setup() throws Exception {
webServer.addServlet("/admin", servletHolder);
webServer.addServlet("/lookup", servletHolder);

webServer.addRestResources("/", VipStatus.class.getPackage().getName(),
VipStatus.ATTRIBUTE_STATUS_FILE_PATH, proxyConfig.getStatusFilePath());
webServer.addRestResource("/", VipStatus.ATTRIBUTE_STATUS_FILE_PATH,
proxyConfig.getStatusFilePath(), VipStatus.class);

// start web-service
webServer.start();
Expand Down
Loading