[Discuss] Enhance Broker Authorization

[Technoboy-]

Motivation

As https://github.com/apache/pulsar/issues/14191 described, users may get confused about the current permission. First, we only define the below actions in the grant-permission interface:

produce,consume,sources,sinks,functions,packages

Though we grant all the actions to some roles like below (myuser is not admin, only a normal user):

$ pulsar-admin namespaces grant-permission public/default --role myuser --actions produce,consume,sources,sinks,functions,packages

But when we list topics under a namespace:

$ pulsar-admin --admin-url https://dev.pulsar.xyz.com:8081 --auth-plugin "org.apache.pulsar.client.impl.auth.AuthenticationToken" --auth-params "token:<token>" topics list public/default

We will get the below error message :

HTTP 500 Server Error

Reason: HTTP 500 Server Error

After https://github.com/apache/pulsar/pull/14638, the user could get a better message :

HTTP 403 : Unauthorized to validateNamespaceOperation for operation [GET_BUNDLE] on namespace [mytenant/np1]

So what is GET_BUNDLE mean? And how to grant this permission? No interface and no docs were mentioned about this. After diving into the codes here : https://github.com/apache/pulsar/blob/4910519eb5c20249d982cab40813af3e870e4f90/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java#L564-L607 We can see from line-572, if the user role is not admin, it can't have the GET_BUNDLE permission. But here, are operations, not actions defined in the grant interface. So, what is the relationship between operations and actions ? No documentations.

Goal

Check up the existing permission logic, clarify the relationship between action and operation, and give detailed documentation.

[mattisonchao]

Great work @Technoboy-

I think some permissions like the following are used to restrict client users.

produce, consume, source, sink, function, package

But currently, we don't have any fine-grained permissions to restrict admin. (seems to be half done)

So, I think we should clearly list the permissions of admin and implement related logic like PIP-49

I'm not very sure about there, Please let me know what you think.

[github-actions[bot]]

The issue had no activity for 30 days, mark with Stale label.

[github-actions[bot]]

The issue had no activity for 30 days, mark with Stale label.