[FEATURE] Add authorization to handle topic metadata request

[Demogorgon314]

#236 Add authorization to handleTopicMetadataRequest.

Fix #415 and #571

Motivation

When client fetch metadata need check topic permission, so we need add authorization in handleTopicMetadataRequest, and do not perform role verification in authentication.

Modifications

Add a common method in KafkaRequestHandler#authorize , this method use authorizer to authorization.
Modify the authentication behavior, and do not verify the role during authentication, verify the role in fetch metadata(#571 )

[BewareMyPower]

My review is completed, PTAL. The main problem is that we should not authorize the CreateTopic operation.

I also add the doc-required label because we may update the docs/security.md later.

[Demogorgon314]

My review is completed, PTAL. The main problem is that we should not authorize the CreateTopic operation.

I also add the doc-required label because we may update the docs/security.md later.

Thanks for review, I will update docs later.

[eolivelli]

This implementation is probably wrong.

I am working on the KOP Proxy and this is the test that fails using the Proxy

https://github.com/datastax/kop/blob/29be05f851c8c6b506703b524fb28d3adecea693/test[…]treamnative/pulsar/handlers/kop/KafkaAuthorizationTestBase.java

In the test we grant AuthAction.consume, AuthAction.produce and the the topic is "visible" using listTopics to ANOTHER_USER.

When you use the KOP proxy we use PulsarAdmin to implement listTopics and the user is not able to "see" the topic, because with Pulsar REST API you need tenant admin role to get the partitions for a topic.

I have filed this issue on Pulsar
apache/pulsar#11945

we have to have a consistent behaviour in KOP

[Demogorgon314]

@eolivelli You're right, the behaviour is not consistent. Current pulsar don't support Topic Level permissions to listTopics, IMO, if we have the topics permissions, we should be able to list the topic?