Skip to content

Commit

Permalink
[fix][test] ProxyWithoutServiceDiscoveryTest should enable authz (#20348
Browse files Browse the repository at this point in the history 
)

(cherry picked from commit 2ebb379)
  • Loading branch information
@michaeljmarshall @lhotari
michaeljmarshall authored and lhotari committed Jan 26, 2024
1 parent 8bab1ec commit d510b1d
Showing 1 changed file with 25 additions and 27 deletions.
52 changes: 25 additions & 27 deletions ...-proxy/src/test/java/org/apache/pulsar/proxy/server/ProxyWithoutServiceDiscoveryTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -54,13 +54,6 @@

public class ProxyWithoutServiceDiscoveryTest extends ProducerConsumerBase {
private static final Logger log = LoggerFactory.getLogger(ProxyWithoutServiceDiscoveryTest.class);

private final String TLS_TRUST_CERT_FILE_PATH = "./src/test/resources/authentication/tls/cacert.pem";
private final String TLS_SERVER_CERT_FILE_PATH = "./src/test/resources/authentication/tls/server-cert.pem";
private final String TLS_SERVER_KEY_FILE_PATH = "./src/test/resources/authentication/tls/server-key.pem";
private final String TLS_CLIENT_CERT_FILE_PATH = "./src/test/resources/authentication/tls/client-cert.pem";
private final String TLS_CLIENT_KEY_FILE_PATH = "./src/test/resources/authentication/tls/client-key.pem";

private ProxyService proxyService;
private ProxyConfiguration proxyConfig = new ProxyConfiguration();

Expand All @@ -73,22 +66,27 @@ protected void setup() throws Exception {

// enable tls and auth&auth at broker
conf.setAuthenticationEnabled(true);
conf.setAuthorizationEnabled(false);
conf.setAuthorizationEnabled(true);

conf.setBrokerServicePortTls(Optional.of(0));
conf.setWebServicePortTls(Optional.of(0));
conf.setTlsTrustCertsFilePath(TLS_TRUST_CERT_FILE_PATH);
conf.setTlsCertificateFilePath(TLS_SERVER_CERT_FILE_PATH);
conf.setTlsKeyFilePath(TLS_SERVER_KEY_FILE_PATH);
conf.setTlsAllowInsecureConnection(true);
conf.setTlsTrustCertsFilePath(CA_CERT_FILE_PATH);
conf.setTlsCertificateFilePath(BROKER_CERT_FILE_PATH);
conf.setTlsKeyFilePath(BROKER_KEY_FILE_PATH);

Set<String> superUserRoles = new HashSet<>();
superUserRoles.add("superUser");
superUserRoles.add("admin");
superUserRoles.add("superproxy");
conf.setSuperUserRoles(superUserRoles);

Set<String> proxyRoles = new HashSet<>();
proxyRoles.add("superproxy");
conf.setProxyRoles(proxyRoles);

conf.setBrokerClientTlsEnabled(true);
conf.setBrokerClientAuthenticationPlugin(AuthenticationTls.class.getName());
conf.setBrokerClientAuthenticationParameters(
"tlsCertFile:" + TLS_CLIENT_CERT_FILE_PATH + "," + "tlsKeyFile:" + TLS_SERVER_KEY_FILE_PATH);
conf.setBrokerClientAuthenticationParameters(String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTlsFileForClient("admin.cert"), getTlsFileForClient("admin.key-pk8")));

Set<String> providers = new HashSet<>();
providers.add(AuthenticationProviderTls.class.getName());
Expand All @@ -113,14 +111,14 @@ protected void setup() throws Exception {
proxyConfig.setTlsEnabledWithBroker(true);

// enable tls and auth&auth at proxy
proxyConfig.setTlsCertificateFilePath(TLS_SERVER_CERT_FILE_PATH);
proxyConfig.setTlsKeyFilePath(TLS_SERVER_KEY_FILE_PATH);
proxyConfig.setTlsTrustCertsFilePath(TLS_TRUST_CERT_FILE_PATH);
proxyConfig.setTlsCertificateFilePath(PROXY_CERT_FILE_PATH);
proxyConfig.setTlsKeyFilePath(PROXY_KEY_FILE_PATH);
proxyConfig.setTlsTrustCertsFilePath(CA_CERT_FILE_PATH);

proxyConfig.setBrokerClientAuthenticationPlugin(AuthenticationTls.class.getName());
proxyConfig.setBrokerClientAuthenticationParameters(
"tlsCertFile:" + TLS_CLIENT_CERT_FILE_PATH + "," + "tlsKeyFile:" + TLS_CLIENT_KEY_FILE_PATH);
proxyConfig.setBrokerClientTrustCertsFilePath(TLS_TRUST_CERT_FILE_PATH);
proxyConfig.setBrokerClientAuthenticationParameters(String.format("tlsCertFile:%s,tlsKeyFile:%s",
getTlsFileForClient("superproxy.cert"), getTlsFileForClient("superproxy.key-pk8")));
proxyConfig.setBrokerClientTrustCertsFilePath(CA_CERT_FILE_PATH);

proxyConfig.setAuthenticationProviders(providers);

Expand All @@ -140,7 +138,7 @@ protected void cleanup() throws Exception {

/**
* <pre>
* It verifies e2e tls + Authentication + Authorization (client -> proxy -> broker>
* It verifies e2e tls + Authentication + Authorization (client -> proxy -> broker)
*
* 1. client connects to proxy over tls and pass auth-data
* 2. proxy authenticate client and retrieve client-role
Expand All @@ -157,8 +155,8 @@ public void testDiscoveryService() throws Exception {
log.info("-- Starting {} test --", methodName);

Map<String, String> authParams = Maps.newHashMap();
authParams.put("tlsCertFile", TLS_CLIENT_CERT_FILE_PATH);
authParams.put("tlsKeyFile", TLS_CLIENT_KEY_FILE_PATH);
authParams.put("tlsCertFile", getTlsFileForClient("admin.cert"));
authParams.put("tlsKeyFile", getTlsFileForClient("admin.key-pk8"));
Authentication authTls = new AuthenticationTls();
authTls.configure(authParams);
// create a client which connects to proxy over tls and pass authData
Expand Down Expand Up @@ -201,10 +199,10 @@ public void testDiscoveryService() throws Exception {
}

protected final PulsarClient createPulsarClient(Authentication auth, String lookupUrl) throws Exception {
admin = spy(PulsarAdmin.builder().serviceHttpUrl(brokerUrlTls.toString()).tlsTrustCertsFilePath(TLS_TRUST_CERT_FILE_PATH)
.allowTlsInsecureConnection(true).authentication(auth).build());
admin = spy(PulsarAdmin.builder().serviceHttpUrl(brokerUrlTls.toString()).tlsTrustCertsFilePath(CA_CERT_FILE_PATH)
.authentication(auth).build());
return PulsarClient.builder().serviceUrl(lookupUrl).statsInterval(0, TimeUnit.SECONDS)
.tlsTrustCertsFilePath(TLS_TRUST_CERT_FILE_PATH).allowTlsInsecureConnection(true).authentication(auth)
.tlsTrustCertsFilePath(CA_CERT_FILE_PATH).authentication(auth)
.enableTls(true).build();
}

Expand Down

0 comments on commit d510b1d

Please sign in to comment.