ivankelly commented on a change in pull request #2028: Original principal
authorization for admin API
URL: https://github.com/apache/incubator-pulsar/pull/2028#discussion_r198424905
##########
File path:
pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java
##########
@@ -198,7 +219,21 @@ protected static void
validateAdminAccessForTenant(PulsarService pulsar, String
throw new RestException(Status.FORBIDDEN, "Need to
authenticate to perform the request");
}
- if
(pulsar.getConfiguration().getSuperUserRoles().contains(clientAppId)) {
+ if
(pulsar.getConfiguration().getProxyRoles().contains(clientAppId)) {
+ boolean proxyAuthorized =
pulsar.getConfiguration().getSuperUserRoles().contains(clientAppId)
+ || tenantInfo.getAdminRoles().contains(clientAppId);
+ boolean originalPrincipalAuthorized =
!StringUtils.isBlank(originalPrincipal)
Review comment:
will do
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
