zhaohai666 opened a new issue, #10634:
URL: https://github.com/apache/rocketmq/issues/10634
### Before Creating the Enhancement Request
- [x] I have confirmed that this should be classified as an enhancement
rather than a bug/feature.
### Summary
# [studio] feat: Proxy Admin Authentication and Security Interceptor
## Background
This is the third atomic PR in the RIP-2 (Proxy Admin Interface) series. It
implements the security layer for the admin gRPC service, ensuring that only
authenticated and authorized clients can invoke admin APIs.
## Design Proposal
### Authentication Interceptor
- **ProxyAdminAuthInterceptor**: A gRPC `ServerInterceptor` that validates
admin requests before they reach the service handler. Supports two
authentication modes:
- **Token-based**: Validates a static or rotating token passed via gRPC
metadata
- **ACL-based**: Delegates to the existing RocketMQ ACL framework for
fine-grained permission checks
### Pipeline Integration
- **HeaderInterceptor**: Extended to extract admin-specific headers (client
identity, request source) and populate them into the gRPC context
- **AuthenticationPipeline**: Updated to include the admin auth interceptor
in the processing chain, positioned after context initialization but before
business logic
- **ContextInitPipeline**: Modified to initialize admin-specific context
variables (admin session ID, permission scope)
### Context Extension
- **ProxyContext**: Extended with admin-related fields (isAdminRequest,
adminClientId, permissionLevel)
- **ContextVariable**: New enum values for admin context keys
### Security Model
```
Request → HeaderInterceptor (extract headers)
→ ContextInitPipeline (init admin context)
→ ProxyAdminAuthInterceptor (validate auth)
→ ProxyAdminGrpcService (business logic)
```
## Scope
| File | Type | Description |
|------|------|-------------|
| `ProxyAdminAuthInterceptor.java` | New | Authentication interceptor |
| `HeaderInterceptor.java` | Modified | Admin header extraction |
| `AuthenticationPipeline.java` | Modified | Admin auth chain integration |
| `ContextInitPipeline.java` | Modified | Admin context initialization |
| `ProxyContext.java` | Modified | Admin context fields |
| `ContextVariable.java` | Modified | Admin context variable keys |
| `ProxyAdminSecurityTest.java` | New | Security integration tests (681
lines) |
| `ProxyAdminAuthInterceptorTest.java` | New | Interceptor unit tests |
**Total: 8 files, +1409 lines**
## Dependencies
- Depends on PR #2 (gRPC service binding)
## Testing
- Unit tests for interceptor: valid token, expired token, missing token, ACL
denial
- Security integration tests: end-to-end auth flow, pipeline ordering,
context propagation
- Negative tests: unauthorized access attempts, malformed headers
## Branch
`feature/rip-2-pr3-security-interceptor`
### Motivation
# [studio] feat: Proxy Admin Authentication and Security Interceptor
## Background
This is the third atomic PR in the RIP-2 (Proxy Admin Interface) series. It
implements the security layer for the admin gRPC service, ensuring that only
authenticated and authorized clients can invoke admin APIs.
## Design Proposal
### Authentication Interceptor
- **ProxyAdminAuthInterceptor**: A gRPC `ServerInterceptor` that validates
admin requests before they reach the service handler. Supports two
authentication modes:
- **Token-based**: Validates a static or rotating token passed via gRPC
metadata
- **ACL-based**: Delegates to the existing RocketMQ ACL framework for
fine-grained permission checks
### Pipeline Integration
- **HeaderInterceptor**: Extended to extract admin-specific headers (client
identity, request source) and populate them into the gRPC context
- **AuthenticationPipeline**: Updated to include the admin auth interceptor
in the processing chain, positioned after context initialization but before
business logic
- **ContextInitPipeline**: Modified to initialize admin-specific context
variables (admin session ID, permission scope)
### Context Extension
- **ProxyContext**: Extended with admin-related fields (isAdminRequest,
adminClientId, permissionLevel)
- **ContextVariable**: New enum values for admin context keys
### Security Model
```
Request → HeaderInterceptor (extract headers)
→ ContextInitPipeline (init admin context)
→ ProxyAdminAuthInterceptor (validate auth)
→ ProxyAdminGrpcService (business logic)
```
## Scope
| File | Type | Description |
|------|------|-------------|
| `ProxyAdminAuthInterceptor.java` | New | Authentication interceptor |
| `HeaderInterceptor.java` | Modified | Admin header extraction |
| `AuthenticationPipeline.java` | Modified | Admin auth chain integration |
| `ContextInitPipeline.java` | Modified | Admin context initialization |
| `ProxyContext.java` | Modified | Admin context fields |
| `ContextVariable.java` | Modified | Admin context variable keys |
| `ProxyAdminSecurityTest.java` | New | Security integration tests (681
lines) |
| `ProxyAdminAuthInterceptorTest.java` | New | Interceptor unit tests |
**Total: 8 files, +1409 lines**
## Dependencies
- Depends on PR #2 (gRPC service binding)
## Testing
- Unit tests for interceptor: valid token, expired token, missing token, ACL
denial
- Security integration tests: end-to-end auth flow, pipeline ordering,
context propagation
- Negative tests: unauthorized access attempts, malformed headers
## Branch
`feature/rip-2-pr3-security-interceptor`
### Describe the Solution You'd Like
# [studio] feat: Proxy Admin Authentication and Security Interceptor
## Background
This is the third atomic PR in the RIP-2 (Proxy Admin Interface) series. It
implements the security layer for the admin gRPC service, ensuring that only
authenticated and authorized clients can invoke admin APIs.
## Design Proposal
### Authentication Interceptor
- **ProxyAdminAuthInterceptor**: A gRPC `ServerInterceptor` that validates
admin requests before they reach the service handler. Supports two
authentication modes:
- **Token-based**: Validates a static or rotating token passed via gRPC
metadata
- **ACL-based**: Delegates to the existing RocketMQ ACL framework for
fine-grained permission checks
### Pipeline Integration
- **HeaderInterceptor**: Extended to extract admin-specific headers (client
identity, request source) and populate them into the gRPC context
- **AuthenticationPipeline**: Updated to include the admin auth interceptor
in the processing chain, positioned after context initialization but before
business logic
- **ContextInitPipeline**: Modified to initialize admin-specific context
variables (admin session ID, permission scope)
### Context Extension
- **ProxyContext**: Extended with admin-related fields (isAdminRequest,
adminClientId, permissionLevel)
- **ContextVariable**: New enum values for admin context keys
### Security Model
```
Request → HeaderInterceptor (extract headers)
→ ContextInitPipeline (init admin context)
→ ProxyAdminAuthInterceptor (validate auth)
→ ProxyAdminGrpcService (business logic)
```
## Scope
| File | Type | Description |
|------|------|-------------|
| `ProxyAdminAuthInterceptor.java` | New | Authentication interceptor |
| `HeaderInterceptor.java` | Modified | Admin header extraction |
| `AuthenticationPipeline.java` | Modified | Admin auth chain integration |
| `ContextInitPipeline.java` | Modified | Admin context initialization |
| `ProxyContext.java` | Modified | Admin context fields |
| `ContextVariable.java` | Modified | Admin context variable keys |
| `ProxyAdminSecurityTest.java` | New | Security integration tests (681
lines) |
| `ProxyAdminAuthInterceptorTest.java` | New | Interceptor unit tests |
**Total: 8 files, +1409 lines**
## Dependencies
- Depends on PR #2 (gRPC service binding)
## Testing
- Unit tests for interceptor: valid token, expired token, missing token, ACL
denial
- Security integration tests: end-to-end auth flow, pipeline ordering,
context propagation
- Negative tests: unauthorized access attempts, malformed headers
## Branch
`feature/rip-2-pr3-security-interceptor`
### Describe Alternatives You've Considered
# [studio] feat: Proxy Admin Authentication and Security Interceptor
## Background
This is the third atomic PR in the RIP-2 (Proxy Admin Interface) series. It
implements the security layer for the admin gRPC service, ensuring that only
authenticated and authorized clients can invoke admin APIs.
## Design Proposal
### Authentication Interceptor
- **ProxyAdminAuthInterceptor**: A gRPC `ServerInterceptor` that validates
admin requests before they reach the service handler. Supports two
authentication modes:
- **Token-based**: Validates a static or rotating token passed via gRPC
metadata
- **ACL-based**: Delegates to the existing RocketMQ ACL framework for
fine-grained permission checks
### Pipeline Integration
- **HeaderInterceptor**: Extended to extract admin-specific headers (client
identity, request source) and populate them into the gRPC context
- **AuthenticationPipeline**: Updated to include the admin auth interceptor
in the processing chain, positioned after context initialization but before
business logic
- **ContextInitPipeline**: Modified to initialize admin-specific context
variables (admin session ID, permission scope)
### Context Extension
- **ProxyContext**: Extended with admin-related fields (isAdminRequest,
adminClientId, permissionLevel)
- **ContextVariable**: New enum values for admin context keys
### Security Model
```
Request → HeaderInterceptor (extract headers)
→ ContextInitPipeline (init admin context)
→ ProxyAdminAuthInterceptor (validate auth)
→ ProxyAdminGrpcService (business logic)
```
## Scope
| File | Type | Description |
|------|------|-------------|
| `ProxyAdminAuthInterceptor.java` | New | Authentication interceptor |
| `HeaderInterceptor.java` | Modified | Admin header extraction |
| `AuthenticationPipeline.java` | Modified | Admin auth chain integration |
| `ContextInitPipeline.java` | Modified | Admin context initialization |
| `ProxyContext.java` | Modified | Admin context fields |
| `ContextVariable.java` | Modified | Admin context variable keys |
| `ProxyAdminSecurityTest.java` | New | Security integration tests (681
lines) |
| `ProxyAdminAuthInterceptorTest.java` | New | Interceptor unit tests |
**Total: 8 files, +1409 lines**
## Dependencies
- Depends on PR #2 (gRPC service binding)
## Testing
- Unit tests for interceptor: valid token, expired token, missing token, ACL
denial
- Security integration tests: end-to-end auth flow, pipeline ordering,
context propagation
- Negative tests: unauthorized access attempts, malformed headers
## Branch
`feature/rip-2-pr3-security-interceptor`
### Additional Context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
