|
| 1 | +/** |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one |
| 3 | + * or more contributor license agreements. See the NOTICE file |
| 4 | + * distributed with this work for additional information |
| 5 | + * regarding copyright ownership. The ASF licenses this file |
| 6 | + * to you under the Apache License, Version 2.0 (the |
| 7 | + * "License"); you may not use this file except in compliance |
| 8 | + * with the License. You may obtain a copy of the License at |
| 9 | + * |
| 10 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | + * |
| 12 | + * Unless required by applicable law or agreed to in writing, |
| 13 | + * software distributed under the License is distributed on an |
| 14 | + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 15 | + * KIND, either express or implied. See the License for the |
| 16 | + * specific language governing permissions and limitations |
| 17 | + * under the License. |
| 18 | + */ |
| 19 | +package org.apache.pulsar.proxy.server; |
| 20 | + |
| 21 | +import static java.util.concurrent.TimeUnit.SECONDS; |
| 22 | +import static org.mockito.Mockito.spy; |
| 23 | +import static org.testng.Assert.assertNotNull; |
| 24 | +import static org.testng.Assert.assertTrue; |
| 25 | +import com.google.common.collect.Sets; |
| 26 | +import io.jsonwebtoken.SignatureAlgorithm; |
| 27 | +import java.util.Calendar; |
| 28 | +import java.util.Collections; |
| 29 | +import java.util.HashSet; |
| 30 | +import java.util.Optional; |
| 31 | +import java.util.Properties; |
| 32 | +import java.util.Set; |
| 33 | +import java.util.concurrent.CompletableFuture; |
| 34 | +import java.util.stream.Collectors; |
| 35 | +import javax.crypto.SecretKey; |
| 36 | +import lombok.Cleanup; |
| 37 | +import lombok.extern.slf4j.Slf4j; |
| 38 | +import org.apache.pulsar.broker.authentication.AuthenticationProviderToken; |
| 39 | +import org.apache.pulsar.broker.authentication.AuthenticationService; |
| 40 | +import org.apache.pulsar.broker.authentication.utils.AuthTokenUtils; |
| 41 | +import org.apache.pulsar.client.admin.PulsarAdmin; |
| 42 | +import org.apache.pulsar.client.api.Producer; |
| 43 | +import org.apache.pulsar.client.api.ProducerConsumerBase; |
| 44 | +import org.apache.pulsar.client.api.PulsarClient; |
| 45 | +import org.apache.pulsar.client.impl.ClientCnx; |
| 46 | +import org.apache.pulsar.client.impl.PulsarClientImpl; |
| 47 | +import org.apache.pulsar.client.impl.auth.AuthenticationToken; |
| 48 | +import org.apache.pulsar.common.configuration.PulsarConfigurationLoader; |
| 49 | +import org.apache.pulsar.common.policies.data.ClusterData; |
| 50 | +import org.apache.pulsar.common.policies.data.TenantInfoImpl; |
| 51 | +import org.awaitility.Awaitility; |
| 52 | +import org.mockito.Mockito; |
| 53 | +import org.testng.annotations.AfterClass; |
| 54 | +import org.testng.annotations.BeforeClass; |
| 55 | +import org.testng.annotations.DataProvider; |
| 56 | +import org.testng.annotations.Test; |
| 57 | + |
| 58 | +@Slf4j |
| 59 | +public class ProxyRefreshAuthTest extends ProducerConsumerBase { |
| 60 | + private final SecretKey SECRET_KEY = AuthTokenUtils.createSecretKey(SignatureAlgorithm.HS256); |
| 61 | + |
| 62 | + private ProxyService proxyService; |
| 63 | + private final ProxyConfiguration proxyConfig = new ProxyConfiguration(); |
| 64 | + |
| 65 | + @Override |
| 66 | + protected void doInitConf() throws Exception { |
| 67 | + super.doInitConf(); |
| 68 | + |
| 69 | + // enable tls and auth&auth at broker |
| 70 | + conf.setAuthenticationEnabled(true); |
| 71 | + conf.setAuthorizationEnabled(false); |
| 72 | + conf.setTopicLevelPoliciesEnabled(false); |
| 73 | + conf.setProxyRoles(Collections.singleton("Proxy")); |
| 74 | + conf.setAdvertisedAddress(null); |
| 75 | + conf.setAuthenticateOriginalAuthData(true); |
| 76 | + conf.setBrokerServicePort(Optional.of(0)); |
| 77 | + conf.setWebServicePort(Optional.of(0)); |
| 78 | + |
| 79 | + Set<String> superUserRoles = new HashSet<>(); |
| 80 | + superUserRoles.add("superUser"); |
| 81 | + conf.setSuperUserRoles(superUserRoles); |
| 82 | + |
| 83 | + conf.setAuthenticationProviders(Set.of(AuthenticationProviderToken.class.getName())); |
| 84 | + Properties properties = new Properties(); |
| 85 | + properties.setProperty("tokenSecretKey", AuthTokenUtils.encodeKeyBase64(SECRET_KEY)); |
| 86 | + conf.setProperties(properties); |
| 87 | + |
| 88 | + conf.setClusterName("proxy-authorization"); |
| 89 | + conf.setNumExecutorThreadPoolSize(5); |
| 90 | + |
| 91 | + conf.setAuthenticationRefreshCheckSeconds(1); |
| 92 | + } |
| 93 | + |
| 94 | + @BeforeClass |
| 95 | + @Override |
| 96 | + protected void setup() throws Exception { |
| 97 | + super.init(); |
| 98 | + |
| 99 | + admin = PulsarAdmin.builder().serviceHttpUrl(pulsar.getWebServiceAddress()) |
| 100 | + .authentication(new AuthenticationToken( |
| 101 | + () -> AuthTokenUtils.createToken(SECRET_KEY, "client", Optional.empty()))).build(); |
| 102 | + String namespaceName = "my-tenant/my-ns"; |
| 103 | + admin.clusters().createCluster("proxy-authorization", |
| 104 | + ClusterData.builder().serviceUrlTls(brokerUrlTls.toString()).build()); |
| 105 | + admin.tenants().createTenant("my-tenant", |
| 106 | + new TenantInfoImpl(Sets.newHashSet("appid1", "appid2"), Sets.newHashSet("proxy-authorization"))); |
| 107 | + admin.namespaces().createNamespace(namespaceName); |
| 108 | + |
| 109 | + // start proxy service |
| 110 | + proxyConfig.setAuthenticationEnabled(true); |
| 111 | + proxyConfig.setAuthorizationEnabled(false); |
| 112 | + proxyConfig.setForwardAuthorizationCredentials(true); |
| 113 | + proxyConfig.setBrokerServiceURL(pulsar.getBrokerServiceUrl()); |
| 114 | + proxyConfig.setAdvertisedAddress(null); |
| 115 | + |
| 116 | + proxyConfig.setServicePort(Optional.of(0)); |
| 117 | + proxyConfig.setBrokerProxyAllowedTargetPorts("*"); |
| 118 | + proxyConfig.setWebServicePort(Optional.of(0)); |
| 119 | + |
| 120 | + proxyConfig.setBrokerClientAuthenticationPlugin(AuthenticationToken.class.getName()); |
| 121 | + proxyConfig.setBrokerClientAuthenticationParameters( |
| 122 | + AuthTokenUtils.createToken(SECRET_KEY, "Proxy", Optional.empty())); |
| 123 | + proxyConfig.setAuthenticationProviders(Set.of(AuthenticationProviderToken.class.getName())); |
| 124 | + Properties properties = new Properties(); |
| 125 | + properties.setProperty("tokenSecretKey", AuthTokenUtils.encodeKeyBase64(SECRET_KEY)); |
| 126 | + proxyConfig.setProperties(properties); |
| 127 | + |
| 128 | + proxyService = Mockito.spy(new ProxyService(proxyConfig, |
| 129 | + new AuthenticationService( |
| 130 | + PulsarConfigurationLoader.convertFrom(proxyConfig)))); |
| 131 | + } |
| 132 | + |
| 133 | + @AfterClass(alwaysRun = true) |
| 134 | + @Override |
| 135 | + protected void cleanup() throws Exception { |
| 136 | + super.internalCleanup(); |
| 137 | + proxyService.close(); |
| 138 | + } |
| 139 | + |
| 140 | + private void startProxy(boolean forwardAuthData) throws Exception { |
| 141 | + pulsar.getConfiguration().setAuthenticateOriginalAuthData(forwardAuthData); |
| 142 | + proxyConfig.setForwardAuthorizationCredentials(forwardAuthData); |
| 143 | + proxyService.start(); |
| 144 | + } |
| 145 | + |
| 146 | + @DataProvider |
| 147 | + Object[] forwardAuthDataProvider() { |
| 148 | + return new Object[]{true, false}; |
| 149 | + } |
| 150 | + |
| 151 | + @Test(dataProvider = "forwardAuthDataProvider") |
| 152 | + public void testAuthDataRefresh(boolean forwardAuthData) throws Exception { |
| 153 | + log.info("-- Starting {} test --", methodName); |
| 154 | + |
| 155 | + startProxy(forwardAuthData); |
| 156 | + |
| 157 | + AuthenticationToken authenticationToken = new AuthenticationToken(() -> { |
| 158 | + Calendar calendar = Calendar.getInstance(); |
| 159 | + calendar.add(Calendar.SECOND, 1); |
| 160 | + return AuthTokenUtils.createToken(SECRET_KEY, "client", Optional.of(calendar.getTime())); |
| 161 | + }); |
| 162 | + |
| 163 | + pulsarClient = PulsarClient.builder().serviceUrl(proxyService.getServiceUrl()) |
| 164 | + .authentication(authenticationToken) |
| 165 | + .build(); |
| 166 | + |
| 167 | + String topic = "persistent://my-tenant/my-ns/my-topic1"; |
| 168 | + @Cleanup |
| 169 | + Producer<byte[]> ignored = spy(pulsarClient.newProducer() |
| 170 | + .topic(topic).create()); |
| 171 | + |
| 172 | + PulsarClientImpl pulsarClientImpl = (PulsarClientImpl) pulsarClient; |
| 173 | + Set<CompletableFuture<ClientCnx>> connections = pulsarClientImpl.getCnxPool().getConnections(); |
| 174 | + |
| 175 | + Awaitility.await().during(4, SECONDS).untilAsserted(() -> { |
| 176 | + pulsarClient.getPartitionsForTopic(topic).get(); |
| 177 | + assertTrue(connections.stream().allMatch(n -> { |
| 178 | + try { |
| 179 | + ClientCnx clientCnx = n.get(); |
| 180 | + long timestamp = clientCnx.getLastDisconnectedTimestamp(); |
| 181 | + return timestamp == 0; |
| 182 | + } catch (Exception e) { |
| 183 | + throw new RuntimeException(e); |
| 184 | + } |
| 185 | + })); |
| 186 | + }); |
| 187 | + } |
| 188 | +} |
0 commit comments