Skip to content

[fix][security] Fix grant all permissions but can't list topic. #15501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codelipenghui merged 1 commit into from
May 9, 2022
Merged

[fix][security] Fix grant all permissions but can't list topic. #15501

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...mon/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,6 +480,7 @@ public CompletableFuture<Boolean> allowNamespaceOperationAsync(NamespaceName nam
namespaceName, role, authData, AuthAction.packages);
case GET_TOPIC:
case GET_TOPICS:
case GET_BUNDLE:
return allowConsumeOrProduceOpsAsync(namespaceName, role, authData);
case UNSUBSCRIBE:
case CLEAR_BACKLOG:
Expand All @@ -488,7 +489,6 @@ public CompletableFuture<Boolean> allowNamespaceOperationAsync(NamespaceName nam
case CREATE_TOPIC:
case DELETE_TOPIC:
case ADD_BUNDLE:
case GET_BUNDLE:
case DELETE_BUNDLE:
case GRANT_PERMISSION:
case GET_PERMISSION:
Expand Down
18 changes: 3 additions & 15 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/auth/AuthorizationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,15 +19,13 @@
package org.apache.pulsar.broker.auth;

import static org.mockito.Mockito.when;
import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertFalse;
import static org.testng.Assert.assertTrue;
import static org.testng.Assert.fail;
import java.util.EnumSet;
import org.apache.pulsar.broker.authorization.AuthorizationService;
import org.apache.pulsar.client.admin.PulsarAdmin;
import org.apache.pulsar.client.admin.PulsarAdminBuilder;
import org.apache.pulsar.client.admin.PulsarAdminException;
import org.apache.pulsar.common.naming.TopicDomain;
import org.apache.pulsar.common.naming.TopicName;
import org.apache.pulsar.common.policies.data.AuthAction;
Expand Down Expand Up @@ -232,7 +230,7 @@ public void simple() throws Exception {
}

@Test
public void testGetListWithoutGetBundleOp() throws Exception {
public void testGetListWithGetBundleOp() throws Exception {
String tenant = "p1";
String namespaceV1 = "p1/global/ns1";
String namespaceV2 = "p1/ns2";
Expand All @@ -248,18 +246,8 @@ public void testGetListWithoutGetBundleOp() throws Exception {
.authentication(new MockAuthentication("pass.pass2"))
.build();
when(pulsar.getAdminClient()).thenReturn(admin2);
try {
admin2.topics().getList(namespaceV1, TopicDomain.non_persistent);
} catch (Exception ex) {
assertTrue(ex instanceof PulsarAdminException.NotAuthorizedException);
assertEquals(ex.getMessage(), "Unauthorized to validateNamespaceOperation for operation [GET_BUNDLE] on namespace [p1/global/ns1]");
}
try {
admin2.topics().getList(namespaceV2, TopicDomain.non_persistent);
} catch (Exception ex) {
assertTrue(ex instanceof PulsarAdminException.NotAuthorizedException);
assertEquals(ex.getMessage(), "Unauthorized to validateNamespaceOperation for operation [GET_BUNDLE] on namespace [p1/ns2]");
}
Assert.assertEquals(admin2.topics().getList(namespaceV1, TopicDomain.non_persistent).size(), 0);
Assert.assertEquals(admin2.topics().getList(namespaceV2, TopicDomain.non_persistent).size(), 0);
}

private static void waitForChange() {
Expand Down