ivankelly commented on issue #1991: TLS auth cannot be used between proxy and brokers URL: https://github.com/apache/incubator-pulsar/issues/1991#issuecomment-399403061 My original hunch on the advertising being wrong was incorrect. It does in fact go to the correct address if you have the right set of options configured. my proxy.conf tls bits ``` authenticationEnabled=true authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls authorizationEnabled=true brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls brokerClientAuthenticationParameters=tlsCertFile:/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/client-keys/admin.cert.pem,tlsKeyFile:/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/client-keys/admin.key-pk8.pem brokerClientTrustCertsFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/certs/ca.cert.pem tlsEnabledInProxy=true tlsEnabledWithBroker=true tlsCertificateFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/server-keys/broker.cert.pem tlsKeyFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/server-keys/broker.key-pk8.pem tlsTrustCertsFilePath=/home/ivan/src/pulsar/checkouts/testing-ca/tests/certificate-authority/certs/ca.cert.pem tlsAllowInsecureConnection=true ``` my broker.conf tls bits ``` tlsEnabled=true tlsCertificateFilePath=/pulsar/ssl/broker.cert.pem tlsKeyFilePath=/pulsar/ssl/broker.key-pk8.pem tlsTrustCertsFilePath=/pulsar/ssl/ca.cert.pem authenticationEnabled=true authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls superUserRoles=admin authorizationEnabled=true ``` tlsAllowInsecureConnection doesn't exist in the config file as is. It needs to be documented. This works for the brokerService port. I have another role "ivan". If "ivan" tries to produce to public/default/topic1 via the proxy or broker, he cannot. If the admin user grants "ivan" produce action permissions on the public/default namespace, then he can write. However, if "ivan" uses they admin client against the proxy, he can grant himself any permissions he wants. This is because the proxy is authenticated against the broker as a superuser, anyone authenticated against the proxy gains those superuser powers. There's no forwarding of principal from the proxy for admin like there is for data.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
