From af12da9a7593ff0203278cab144534b12252bca1 Mon Sep 17 00:00:00 2001 From: HuanliMeng <48120384+Huanli-Meng@users.noreply.github.com> Date: Thu, 18 Jun 2020 20:37:20 +0800 Subject: [PATCH 1/5] Update the security overview for PIP 55. the parameter is added to the broker config file by Jia. --- site2/docs/security-overview.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/site2/docs/security-overview.md b/site2/docs/security-overview.md index 7fc177e06fa98..6f8db19d4fce4 100644 --- a/site2/docs/security-overview.md +++ b/site2/docs/security-overview.md @@ -10,6 +10,10 @@ By default, Pulsar configures no encryption, authentication, or authorization. A Pulsar supports a pluggable authentication mechanism. And Pulsar clients use this mechanism to authenticate with brokers and proxies. You can also configure Pulsar to support multiple authentication sources. +The Pulsar broker validates the authentication credentials when a connection is established. After the initial connection is authenticated, the "principal" token is stored for authorization though the connection is not re-authenticated. The Pulsar broker periodically checks the expiration status of every `ServerCnx` object. You can set the `authenticationRefreshCheckSeconds` on the Pulsar broker to control the frequency to check the expiration status. By default, the `authenticationRefreshCheckSeconds` is set to 60s. When the authentication is expired, the Pulsar broker forces to re-authenticate the connection. If the re-authentication fails, the Pulsar broker disconnects the client . + +The Pulsar broker knows whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the Pulsar broker disconnects the client. + You had better secure the service components in your Apache Pulsar deployment. ## Role tokens From fa7a4a471c994c4f7d11bf54ce69aa2dd792639a Mon Sep 17 00:00:00 2001 From: HuanliMeng <48120384+Huanli-Meng@users.noreply.github.com> Date: Thu, 18 Jun 2020 20:54:23 +0800 Subject: [PATCH 2/5] Update security overview for PIP-55. --- site2/docs/security-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/site2/docs/security-overview.md b/site2/docs/security-overview.md index 6f8db19d4fce4..0280eaf89f8db 100644 --- a/site2/docs/security-overview.md +++ b/site2/docs/security-overview.md @@ -10,9 +10,9 @@ By default, Pulsar configures no encryption, authentication, or authorization. A Pulsar supports a pluggable authentication mechanism. And Pulsar clients use this mechanism to authenticate with brokers and proxies. You can also configure Pulsar to support multiple authentication sources. -The Pulsar broker validates the authentication credentials when a connection is established. After the initial connection is authenticated, the "principal" token is stored for authorization though the connection is not re-authenticated. The Pulsar broker periodically checks the expiration status of every `ServerCnx` object. You can set the `authenticationRefreshCheckSeconds` on the Pulsar broker to control the frequency to check the expiration status. By default, the `authenticationRefreshCheckSeconds` is set to 60s. When the authentication is expired, the Pulsar broker forces to re-authenticate the connection. If the re-authentication fails, the Pulsar broker disconnects the client . +The Pulsar broker validates the authentication credentials when a connection is established. After the initial connection is authenticated, the "principal" token is stored for authorization though the connection is not re-authenticated. The broker periodically checks the expiration status of every `ServerCnx` object. You can set the `authenticationRefreshCheckSeconds` on the broker to control the frequency to check the expiration status. By default, the `authenticationRefreshCheckSeconds` is set to 60s. When the authentication is expired, the broker forces to re-authenticate the connection. If the re-authentication fails, the broker disconnects the client . -The Pulsar broker knows whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the Pulsar broker disconnects the client. +The broker knows whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the broker disconnects the client. You had better secure the service components in your Apache Pulsar deployment. From c301106bf796a63a79d41e54cddf5bb1588b6132 Mon Sep 17 00:00:00 2001 From: HuanliMeng <48120384+Huanli-Meng@users.noreply.github.com> Date: Mon, 22 Jun 2020 09:32:28 +0800 Subject: [PATCH 3/5] a redundant space --- site2/docs/security-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site2/docs/security-overview.md b/site2/docs/security-overview.md index 0280eaf89f8db..4198c90954959 100644 --- a/site2/docs/security-overview.md +++ b/site2/docs/security-overview.md @@ -10,7 +10,7 @@ By default, Pulsar configures no encryption, authentication, or authorization. A Pulsar supports a pluggable authentication mechanism. And Pulsar clients use this mechanism to authenticate with brokers and proxies. You can also configure Pulsar to support multiple authentication sources. -The Pulsar broker validates the authentication credentials when a connection is established. After the initial connection is authenticated, the "principal" token is stored for authorization though the connection is not re-authenticated. The broker periodically checks the expiration status of every `ServerCnx` object. You can set the `authenticationRefreshCheckSeconds` on the broker to control the frequency to check the expiration status. By default, the `authenticationRefreshCheckSeconds` is set to 60s. When the authentication is expired, the broker forces to re-authenticate the connection. If the re-authentication fails, the broker disconnects the client . +The Pulsar broker validates the authentication credentials when a connection is established. After the initial connection is authenticated, the "principal" token is stored for authorization though the connection is not re-authenticated. The broker periodically checks the expiration status of every `ServerCnx` object. You can set the `authenticationRefreshCheckSeconds` on the broker to control the frequency to check the expiration status. By default, the `authenticationRefreshCheckSeconds` is set to 60s. When the authentication is expired, the broker forces to re-authenticate the connection. If the re-authentication fails, the broker disconnects the client. The broker knows whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the broker disconnects the client. From 8c55c9a3f05804d3fcdad361a706456d251ae01c Mon Sep 17 00:00:00 2001 From: HuanliMeng <48120384+Huanli-Meng@users.noreply.github.com> Date: Mon, 22 Jun 2020 09:51:05 +0800 Subject: [PATCH 4/5] doc based on Jennifer's comments --- site2/docs/security-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site2/docs/security-overview.md b/site2/docs/security-overview.md index 4198c90954959..ff857e648353a 100644 --- a/site2/docs/security-overview.md +++ b/site2/docs/security-overview.md @@ -12,7 +12,7 @@ Pulsar supports a pluggable authentication mechanism. And Pulsar clients use thi The Pulsar broker validates the authentication credentials when a connection is established. After the initial connection is authenticated, the "principal" token is stored for authorization though the connection is not re-authenticated. The broker periodically checks the expiration status of every `ServerCnx` object. You can set the `authenticationRefreshCheckSeconds` on the broker to control the frequency to check the expiration status. By default, the `authenticationRefreshCheckSeconds` is set to 60s. When the authentication is expired, the broker forces to re-authenticate the connection. If the re-authentication fails, the broker disconnects the client. -The broker knows whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the broker disconnects the client. +The broker supports to learn whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the broker disconnects the client. You had better secure the service components in your Apache Pulsar deployment. From 6b90a545ec5e344b95c6217f72e5fccb8dbe0750 Mon Sep 17 00:00:00 2001 From: HuanliMeng <48120384+Huanli-Meng@users.noreply.github.com> Date: Mon, 22 Jun 2020 21:16:51 +0800 Subject: [PATCH 5/5] doc based on Jennifer's comments. --- site2/docs/security-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site2/docs/security-overview.md b/site2/docs/security-overview.md index ff857e648353a..a6de902ddd397 100644 --- a/site2/docs/security-overview.md +++ b/site2/docs/security-overview.md @@ -12,7 +12,7 @@ Pulsar supports a pluggable authentication mechanism. And Pulsar clients use thi The Pulsar broker validates the authentication credentials when a connection is established. After the initial connection is authenticated, the "principal" token is stored for authorization though the connection is not re-authenticated. The broker periodically checks the expiration status of every `ServerCnx` object. You can set the `authenticationRefreshCheckSeconds` on the broker to control the frequency to check the expiration status. By default, the `authenticationRefreshCheckSeconds` is set to 60s. When the authentication is expired, the broker forces to re-authenticate the connection. If the re-authentication fails, the broker disconnects the client. -The broker supports to learn whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the broker disconnects the client. +The broker supports learning whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the `refreshAuthentication` method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the broker disconnects the client. You had better secure the service components in your Apache Pulsar deployment.