alibaba / nacos

an easy-to-use dynamic service discovery, configuration and service management platform for building cloud native applications.
https://nacos.io
Apache License 2.0
30.27k stars 12.84k forks source link

nacos-client, the default value of namespace set for naming and config is inconsistent, resulting in permission authentication failure #3525

Open Maijh97 opened 4 years ago

Maijh97 commented 4 years ago

Describe the bug

1)nacos-client naming进行服务注册,当namespace没有指定,会默认为public,参考代码为: com.alibaba.nacos.client.naming.utils.InitUtils#initNamespaceForNaming config进行获取配置,当namespace没有指定,会默认为空字符 "", 参考代码为: com.alibaba.nacos.client.utils.ParamUtil#parseNamespace

2)控制台新建权限 如果分配的资源为public,这时候数据表permissions中的resource字段就会为 :*:* ,如果是分配其它自定义命名空间的资源就会为 07ba088a-4782-468e-80cc-ee758beab327:*:*

3)com.alibaba.nacos.core.auth.AuthFilter权限拦截校验 如果是config请求,组装的权限resource:DEFAULT_GROUP:config/service-gateway 如果是naming请求,组装的权限resourcepublic:DEFAULT_GROUP:naming/service-gateway 导致使用java.util.regex.Pattern#matches方法匹配权限, naming请求权限会不足 伪代码:

a = ":*:*";
b = "public:DEFAULT_GROUP:naming/service-gateway";  // naming
c = ":DEFAULT_GROUP:config/service-gateway";  // config

Pattern.matches(a, b); false
Pattern.matches(a, c); true

Expected behavior

希望能统一nacos-clientnamespace默认值; 比如confignamespace没有指定的情况下应该也默认为public 在新建资源的时候,当选择的资源为public的时候, resource应为: public:*:*

Acutally behavior

How to Reproduce

Desktop (please complete the following information):

Additional context Add any other context about the problem here.

KomachiSion commented 4 years ago

is related with #3524 ?

Maijh97 commented 4 years ago

is related with #3524 ?

yes

Maijh97 commented 4 years ago

Also related to the #2620 issue