RobertIndie commented on a change in pull request #10685:
URL: https://github.com/apache/pulsar/pull/10685#discussion_r637806980
##########
File path:
pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java
##########
@@ -149,7 +150,13 @@ public String authenticate(AuthenticationDataSource
authData) throws Authenticat
String token;
token = getToken(authData);
// Parse Token by validating
- String role = getPrincipal(authenticateToken(token));
+ String role;
+ List<String> principals = getPrincipals(authenticateToken(token));
+ if (principals == null) { // Empty list check has been done in
getPrincipals.
+ role = null;
+ } else {
+ role = principals.get(0);
Review comment:
Thanks for your review.
This is for being compatible with the original single role authentication. I
just changed it to multi roles authenticate method in
https://github.com/apache/pulsar/pull/10685/commits/cf646e47ea6f83dd596fff882c644471698045c1
to make it support both single role and multi roles authentication.
For authorization, we use `AuthenticationState.getAuthRoles()` to get the
roles array in
[`ServerCnx`](https://github.com/RobertIndie/pulsar/blob/cf646e47ea6f83dd596fff882c644471698045c1/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java#L630),
then use this array to authorize. It doesn't go through this `authenticate`
method.
([Detail](https://github.com/RobertIndie/pulsar/blob/cf646e47ea6f83dd596fff882c644471698045c1/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationProviderToken.java#L203))
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
