[Authenticate] fix Invalid signature error when use Kerberos Authentication #15121

liudezhi2098 · 2022-04-11T12:17:23Z

Motivation

When use Kerberos authentication , using Pulsar Admin to query topic state, will appear HTTP 401 Unauthorized, becasue
request redirect url will use current SaslRoleToken ，but redirect broker not recognized the token, per broker secret is not same.

WARN  org.apache.pulsar.broker.web.AuthenticationFilter - [10.3.0.4] Failed to authenticate HTTP request: Invalid signature

per broker secret is Random

protected String computeSignature(String str) {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-512");

            md.update(str.getBytes());

            md.update(secret);
            byte[] digest = md.digest();
            return new Base64(0).encodeToString(digest);
        } catch (NoSuchAlgorithmException ex) {
            throw new RuntimeException("It should not happen, " + ex.getMessage(), ex);
        }
    }

Modifications

secret can configuration
this.signer = new SaslRoleTokenSigner(config.getSaslJaasServerRoleTokenSignerSecret().getBytes());

Does this pull request potentially affect one of the following parts:

If yes was chosen, please highlight the changes

Dependencies (does it add or upgrade a dependency): (yes / no)
The public API: (no)
The schema: (no )
The default values of configurations: (yes)
The wire protocol: (no)
The rest endpoints: (no)
The admin cli options: ( no)
Anything that affects deployment: (no)

Documentation

Need to update docs?

doc

…ation

github-actions · 2022-04-11T12:30:46Z

@liudezhi2098:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)

liudezhi2098 · 2022-04-12T00:41:58Z

/pulsarbot run-failure-checks

Anonymitaet · 2022-04-12T02:40:58Z

@liudezhi2098 I see you label this PR w/ doc but seems that there is no doc update in this PR?

…nature

liudezhi2098 · 2022-04-12T03:24:56Z

@liudezhi2098 I see you label this PR w/ doc but seems that there is no doc update in this PR?

Wait for this pr to approved, I will submit another pr.

…r.conf

Anonymitaet · 2022-04-12T07:08:31Z

@liudezhi2098 I see you label this PR w/ doc but seems that there is no doc update in this PR?

Wait for this pr to approved, I will submit another pr.

so this PR should be labeled w/ doc-required.

Anonymitaet · 2022-04-12T07:09:18Z

@momo-jun a soft reminder: here is a PR w/ doc-required label, could u pls follow up? Thanks

liudezhi2098 · 2022-04-12T10:11:35Z

@codelipenghui @jiazhai PTAL

momo-jun · 2022-04-12T11:24:00Z

@liudezhi2098 feel free to ping me when you need review or any help on the follow-up doc PR.

liudezhi2098 · 2022-04-12T13:05:14Z

@liudezhi2098 feel free to ping me when you need review or any help on the follow-up doc PR.
👌

pulsar-broker-common/src/main/java/org/apache/pulsar/broker/ServiceConfiguration.java

conf/broker.conf

…nature

liudezhi2098 · 2022-04-15T03:01:38Z

/pulsarbot run-failure-checks

…nature

eolivelli

Having a constant secret looks like a security hole to me.

Can you please explain more?

@michaeljmarshall PTAL

liudezhi2098 · 2022-04-15T10:08:12Z

Having a constant secret looks like a security hole to me.

Can you please explain more?

@eolivelli becasue DefaultAsyncHttpClient will automatic request redirect url , and use current SaslRoleToken, there is currently no place to modify, so requesting to another broker, the saslRoleTokenSigner check failed.
If you use rest api, it will also cause this problem, having a constant secret , there will be certain security risks, but the key is stored on the broker side, and the client side does get.
eg :

DefaultAsyncHttpClientConfig.Builder confBuilder = new DefaultAsyncHttpClientConfig.Builder();
confBuilder.setFollowRedirect(true);

liudezhi2098 · 2022-05-10T07:44:21Z

@eolivelli @lhotari thank you very much , PTAL.

eolivelli

LGTM

liudezhi2098 · 2022-05-10T12:50:28Z

/pulsarbot run-failure-checks

…cation (apache#15121) * fix SaslRoleTokenSigner Invalid signature when use Kerberos Authentication * fix checkstyle violation * add saslJaasServerRoleTokenSignerSecret configuration fields in broker.conf * add secret in proxy.conf * supply the secret as a file * set default value * fix test error * fix test error * saslJaasServerRoleTokenSignerSecretPath must be set * add secret configuration into the WorkerConfig and the conf/functions_worker.yml * fix checkstyle error * chang URL.createURL to URI.create Co-authored-by: liudezhi <liudezhi2098@163.com> ### Motivation When use Kerberos authentication , using Pulsar Admin to query topic state, will appear HTTP 401 Unauthorized, becasue request redirect url will use current SaslRoleToken ，but redirect broker not recognized the token, per broker secret is not same. ``` WARN org.apache.pulsar.broker.web.AuthenticationFilter - [10.3.0.4] Failed to authenticate HTTP request: Invalid signature ``` per broker secret is Random ``` protected String computeSignature(String str) { try { MessageDigest md = MessageDigest.getInstance("SHA-512"); md.update(str.getBytes()); md.update(secret); byte[] digest = md.digest(); return new Base64(0).encodeToString(digest); } catch (NoSuchAlgorithmException ex) { throw new RuntimeException("It should not happen, " + ex.getMessage(), ex); } } ``` ### Modifications secret can configuration `this.signer = new SaslRoleTokenSigner(config.getSaslJaasServerRoleTokenSignerSecret().getBytes());` ### Does this pull request potentially affect one of the following parts: *If `yes` was chosen, please highlight the changes* - Dependencies (does it add or upgrade a dependency): (yes / no) - The public API: (no) - The schema: (no ) - The default values of configurations: (yes) - The wire protocol: (no) - The rest endpoints: (no) - The admin cli options: ( no) - Anything that affects deployment: (no) ### Documentation Need to update docs? - [x] `doc` (cherry picked from commit f0b7efa)

…Authentication (apache#15121)" This reverts commit 6381128.

…cation (#15121) * fix SaslRoleTokenSigner Invalid signature when use Kerberos Authentication * fix checkstyle violation * add saslJaasServerRoleTokenSignerSecret configuration fields in broker.conf * add secret in proxy.conf * supply the secret as a file * set default value * fix test error * fix test error * saslJaasServerRoleTokenSignerSecretPath must be set * add secret configuration into the WorkerConfig and the conf/functions_worker.yml * fix checkstyle error * chang URL.createURL to URI.create Co-authored-by: liudezhi <liudezhi2098@163.com> When use Kerberos authentication , using Pulsar Admin to query topic state, will appear HTTP 401 Unauthorized, becasue request redirect url will use current SaslRoleToken ，but redirect broker not recognized the token, per broker secret is not same. ``` WARN org.apache.pulsar.broker.web.AuthenticationFilter - [10.3.0.4] Failed to authenticate HTTP request: Invalid signature ``` per broker secret is Random ``` protected String computeSignature(String str) { try { MessageDigest md = MessageDigest.getInstance("SHA-512"); md.update(str.getBytes()); md.update(secret); byte[] digest = md.digest(); return new Base64(0).encodeToString(digest); } catch (NoSuchAlgorithmException ex) { throw new RuntimeException("It should not happen, " + ex.getMessage(), ex); } } ``` secret can configuration `this.signer = new SaslRoleTokenSigner(config.getSaslJaasServerRoleTokenSignerSecret().getBytes());` *If `yes` was chosen, please highlight the changes* - Dependencies (does it add or upgrade a dependency): (yes / no) - The public API: (no) - The schema: (no ) - The default values of configurations: (yes) - The wire protocol: (no) - The rest endpoints: (no) - The admin cli options: ( no) - Anything that affects deployment: (no) Need to update docs? - [x] `doc` (cherry picked from commit f0b7efa)

…ServerRoleTokenSignerSecretPath after cherry-pick apache#15121

…ServerRoleTokenSignerSecretPath after cherry-pick #15121 (#19971) After cherry-picked #15121 into branch-2.10 to solve the issue sasl authentication failure, we will do a follow-up process to keep the new configuration `saslJaasServerRoleTokenSignerSecretPath` forward compatible: make this config optinal.

…cation (apache#15121) * fix SaslRoleTokenSigner Invalid signature when use Kerberos Authentication * fix checkstyle violation * add saslJaasServerRoleTokenSignerSecret configuration fields in broker.conf * add secret in proxy.conf * supply the secret as a file * set default value * fix test error * fix test error * saslJaasServerRoleTokenSignerSecretPath must be set * add secret configuration into the WorkerConfig and the conf/functions_worker.yml * fix checkstyle error * chang URL.createURL to URI.create Co-authored-by: liudezhi <liudezhi2098@163.com> When use Kerberos authentication , using Pulsar Admin to query topic state, will appear HTTP 401 Unauthorized, becasue request redirect url will use current SaslRoleToken ，but redirect broker not recognized the token, per broker secret is not same. ``` WARN org.apache.pulsar.broker.web.AuthenticationFilter - [10.3.0.4] Failed to authenticate HTTP request: Invalid signature ``` per broker secret is Random ``` protected String computeSignature(String str) { try { MessageDigest md = MessageDigest.getInstance("SHA-512"); md.update(str.getBytes()); md.update(secret); byte[] digest = md.digest(); return new Base64(0).encodeToString(digest); } catch (NoSuchAlgorithmException ex) { throw new RuntimeException("It should not happen, " + ex.getMessage(), ex); } } ``` secret can configuration `this.signer = new SaslRoleTokenSigner(config.getSaslJaasServerRoleTokenSignerSecret().getBytes());` *If `yes` was chosen, please highlight the changes* - Dependencies (does it add or upgrade a dependency): (yes / no) - The public API: (no) - The schema: (no ) - The default values of configurations: (yes) - The wire protocol: (no) - The rest endpoints: (no) - The admin cli options: ( no) - Anything that affects deployment: (no) Need to update docs? - [x] `doc` (cherry picked from commit f0b7efa) (cherry picked from commit 72b9552)

…ServerRoleTokenSignerSecretPath after cherry-pick apache#15121 (apache#19971) After cherry-picked apache#15121 into branch-2.10 to solve the issue sasl authentication failure, we will do a follow-up process to keep the new configuration `saslJaasServerRoleTokenSignerSecretPath` forward compatible: make this config optinal. (cherry picked from commit cef4f71)

fix SaslRoleTokenSigner Invalid signature when use Kerberos Authentic…

3acb8d9

…ation

github-actions bot assigned liudezhi2098 Apr 11, 2022

github-actions bot added the doc-label-missing label Apr 11, 2022

Merge branch 'apache:master' into fix_saslRoleTokenSigner_Invalid_sig…

efcd111

…nature

liudezhi2098 added 2 commits April 12, 2022 11:30

fix checkstyle violation

eddb604

add saslJaasServerRoleTokenSignerSecret configuration fields in broke…

a974dc8

…r.conf

Anonymitaet added doc-required Your PR changes impact docs and you will update later. and removed doc-label-missing labels Apr 12, 2022

codelipenghui reviewed Apr 13, 2022

View reviewed changes

pulsar-broker-common/src/main/java/org/apache/pulsar/broker/ServiceConfiguration.java Outdated Show resolved Hide resolved

conf/broker.conf Outdated Show resolved Hide resolved

add secret in proxy.conf

0bc6cff

liudezhi2098 requested a review from codelipenghui April 13, 2022 01:46

codelipenghui approved these changes Apr 13, 2022

View reviewed changes

codelipenghui added this to the 2.11.0 milestone Apr 13, 2022

jiazhai approved these changes Apr 13, 2022

View reviewed changes

gaozhangmin approved these changes Apr 13, 2022

View reviewed changes

liudezhi2098 mentioned this pull request Apr 14, 2022

[feat][doc] Add saslJaasServerRoleTokenSignerSecret parameter in security-kerberos.md #15172

Merged

1 task

Merge branch 'apache:master' into fix_saslRoleTokenSigner_Invalid_sig…

fb39469

…nature

Merge branch 'apache:master' into fix_saslRoleTokenSigner_Invalid_sig…

1da4286

…nature

eolivelli requested changes Apr 15, 2022

View reviewed changes

liudezhi2098 requested review from eolivelli and lhotari May 10, 2022 07:34

eolivelli approved these changes May 10, 2022

View reviewed changes

lhotari approved these changes May 10, 2022

View reviewed changes

michaeljmarshall merged commit f0b7efa into apache:master May 10, 2022

michaeljmarshall added area/security area/authn labels May 10, 2022

liudezhi2098 mentioned this pull request Jun 2, 2022

[fix][doc] Add saslJaasServerRoleTokenSignerSecret parameter in security-kerberos.md #15884

Closed

1 task

Anonymitaet added doc-complete Your PR changes impact docs and the related docs have been already added. and removed doc-required Your PR changes impact docs and you will update later. labels Jun 6, 2022

poorbarcode added release/2.11.0 release/2.10.5 release/2.11.1 cherry-picked/branch-2.10 and removed release/2.11.0 release/2.11.1 cherry-picked/branch-2.10 release/2.10.5 labels Mar 20, 2023

poorbarcode added a commit to poorbarcode/pulsar that referenced this pull request Mar 20, 2023

Revert "[Authenticate] fix Invalid signature error when use Kerberos …

ff877ef

…Authentication (apache#15121)" This reverts commit 6381128.

poorbarcode added a commit to poorbarcode/pulsar that referenced this pull request Mar 30, 2023

[branch-2.10] [fix] [auth] fix not forward compatible config saslJaas…

a800c17

…ServerRoleTokenSignerSecretPath after cherry-pick apache#15121

poorbarcode mentioned this pull request Mar 30, 2023

[branch-2.10] [fix] [auth] fix not forward compatible config saslJaasServerRoleTokenSignerSecretPath after cherry-pick #15121 #19971

Merged

4 tasks

poorbarcode added a commit to poorbarcode/pulsar that referenced this pull request Apr 3, 2023

[branch-2.10] [fix] [auth] fix not forward compatible config saslJaas…

105c9c7

…ServerRoleTokenSignerSecretPath after cherry-pick apache#15121

[Authenticate] fix Invalid signature error when use Kerberos Authentication #15121

[Authenticate] fix Invalid signature error when use Kerberos Authentication #15121

Uh oh!

Conversation

liudezhi2098 commented Apr 11, 2022

Motivation

Modifications

Does this pull request potentially affect one of the following parts:

Documentation

Uh oh!

github-actions bot commented Apr 11, 2022

Uh oh!

liudezhi2098 commented Apr 12, 2022

Uh oh!

Anonymitaet commented Apr 12, 2022

Uh oh!

liudezhi2098 commented Apr 12, 2022

Uh oh!

Anonymitaet commented Apr 12, 2022

Uh oh!

Anonymitaet commented Apr 12, 2022

Uh oh!

liudezhi2098 commented Apr 12, 2022

Uh oh!

momo-jun commented Apr 12, 2022

Uh oh!

liudezhi2098 commented Apr 12, 2022

Uh oh!

Uh oh!

Uh oh!

liudezhi2098 commented Apr 15, 2022

Uh oh!

eolivelli left a comment

Choose a reason for hiding this comment

Uh oh!

liudezhi2098 commented Apr 15, 2022

Uh oh!

liudezhi2098 commented May 10, 2022

Uh oh!

eolivelli left a comment

Choose a reason for hiding this comment

Uh oh!

liudezhi2098 commented May 10, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants