[GitHub] [pulsar] ethqunzhong opened a new issue, #15429: [Broker] Broker Lookup authentication failed while call get-subscriptions API with JWT authentication.

[GitBox]

ethqunzhong opened a new issue, #15429:
URL: https://github.com/apache/pulsar/issues/15429

   **Describe the bug**
   We upgrade Broker version to 2.8.3 from 2.7.2.
   while we call rest api / python client to get topics subscriptions not get 
except result as normal. 
   log says **authentication failed for provider token: Invalid HTTP 
Authorization header.**
   this phenomenon seem as `HTTP Authorization header` lost while client lookup 
the topic subscriptions by redirect http request to the own broker. 
   
   **Additional context**
   - use `bin/pulsar-admin` is workable.
   - direct connect the topic own broker is workable.
   - get subscriptions in k8s-cluster is workable.
   
   **Expected behavior**
   return topics subscriptions & HTTP Response Code should be 307 & 200.
   
   **Screenshots**
   this log shows the whole process
   1. to the non-own broker and trigger lookup & redirect http request
   ```
   20:55:33.015 [pulsar-web-41-5] DEBUG org.eclipse.jetty.server.HttpChannel - 
REQUEST for //11.179.0.109:8080/admin/v2/persistent/qunzhon
   g/qunzhong/qunzhongp12/subscriptions/?authoritative=false on 
HttpChannelOverHttp@353dd8b0{s=HttpChannelState@20a9016c{s=IDLE rs=BLOCKIN
   G os=OPEN is=IDLE awp=false se=false i=true 
al=0},r=1,c=false/false,a=IDLE,uri=//11.179.0.109:8080/admin/v2/persistent/qunzhong/qunzhon
   g/qunzhongp12/subscriptions/?authoritative=false,age=0}
   GET 
//11.179.0.109:8080/admin/v2/persistent/qunzhong/qunzhong/qunzhongp12/subscriptions/?authoritative=false
 HTTP/1.1
   User-Agent: curl/7.29.0
   Host: 11.179.0.109:8080
   Accept: */*
   Content-Type: application/json
   Authorization: Bearer 
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbiJ9.Gdz-MgM06x10gH8QxE91ZM_Ig8L6mvLB1lZ9B8o9qVI
   
   
   20:55:33.016 [pulsar-web-41-5] DEBUG 
org.apache.pulsar.broker.web.AuthenticationFilter - [9.146.225.131] 
Authenticated HTTP request wit
   h role admin
   20:55:33.017 [pulsar-web-41-5] DEBUG 
org.eclipse.jetty.server.HttpChannelState - startAsync 
HttpChannelState@20a9016c{s=HANDLING rs=BLO
   CKING os=OPEN is=IDLE awp=false se=false i=true al=0}
   20:55:33.017 [pulsar-web-41-5] DEBUG 
org.apache.pulsar.broker.namespace.NamespaceService - Getting web service URL 
of topic: persistent
   ://qunzhong/qunzhong/qunzhongp12 - options: 
LookupOptions(authoritative=false, readOnly=false, loadTopicsInBundle=false, 
requestHttps=f
   alse, advertisedListenerName=null)
   
   
   20:55:33.016 [pulsar-web-41-5] DEBUG 
org.apache.pulsar.broker.web.AuthenticationFilter - [9.146.225.131] 
Authenticated HTTP request wit
   h role admin
   20:55:33.017 [pulsar-web-41-5] DEBUG 
org.eclipse.jetty.server.HttpChannelState - startAsync 
HttpChannelState@20a9016c{s=HANDLING rs=BLO
   CKING os=OPEN is=IDLE awp=false se=false i=true al=0}
   20:55:33.017 [pulsar-web-41-5] DEBUG 
org.apache.pulsar.broker.namespace.NamespaceService - Getting web service URL 
of topic: persistent
   ://qunzhong/qunzhong/qunzhongp12 - options: 
LookupOptions(authoritative=false, readOnly=false, loadTopicsInBundle=false, 
requestHttps=f
   alse, advertisedListenerName=null)
   20:55:33.017 [pulsar-web-41-5] DEBUG 
org.apache.pulsar.broker.namespace.NamespaceService - findBrokerServiceUrl: 
qunzhong/qunzhong/0x40
   000000_0x44000000 - options: LookupOptions(authoritative=false, 
readOnly=false, loadTopicsInBundle=false, requestHttps=false, advertise
   dListenerName=null)
   20:55:33.017 [pulsar-web-41-5] DEBUG 
org.apache.pulsar.broker.namespace.NamespaceService - Namespace bundle 
qunzhong/qunzhong/0x4000000
   0_0x44000000 already owned by 
Optional[NamespaceEphemeralData{nativeUrl=pulsar://11.134.241.237:6650, 
httpUrl=http://11.134.241.237:808
   0, disabled=false, advertisedListeners={}}]
   20:55:33.017 [pulsar-web-41-5] DEBUG 
org.apache.pulsar.broker.web.PulsarWebResource - Redirecting the rest call to 
http://11.134.241.23
   
7:8080/admin/v2/persistent/qunzhong/qunzhong/qunzhongp12/subscriptions/?authoritative=false
   
   
   
   20:55:33.018 [pulsar-web-41-5] DEBUG org.eclipse.jetty.server.HttpChannel - 
COMMIT for /admin/v2/persistent/qunzhong/qunzhong/qunzhongp
   12/subscriptions/ on 
HttpChannelOverHttp@353dd8b0{s=HttpChannelState@20a9016c{s=HANDLING 
rs=COMPLETING os=COMMITTED is=IDLE awp=false s
   e=false i=false 
al=2},r=1,c=false/false,a=HANDLING,uri=//11.179.0.109:8080/admin/v2/persistent/qunzhong/qunzhong/qunzhongp12/subscripti
   ons/?authoritative=false,age=3}
   307 Temporary Redirect HTTP/1.1
   Date: Tue, 26 Apr 2022 12:55:33 GMT
   broker-address: 11.179.0.109
   Location: 
http://11.134.241.237:8080/admin/v2/persistent/qunzhong/qunzhong/qunzhongp12/subscriptions/?authoritative=false
   
   
   20:55:33.018 [pulsar-web-41-5] INFO  org.eclipse.jetty.server.RequestLog - 
9.146.225.131 - - [26/Apr/2022:20:55:33 +0800] "GET /admin/v
   
2/persistent/qunzhong/qunzhong/qunzhongp12/subscriptions/?authoritative=false 
HTTP/1.1" 307 0 "-" "curl/7.29.0" 3
   ```
   
   2. this log is on the own broker 
   <img width="953" alt="image-20220426204910615" 
src="https://user-images.githubusercontent.com/16517186/166685343-51d2c7f4-3868-4544-8317-18aaaf9354ad.png";>
   
   
   
   **Desktop (please complete the following information):**
    - Pulsar Broker Version = 2.8.3
    - Pulsar deploy on physics cluster without proxy which non-k8s cluster.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscr...@pulsar.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org