Skip to content

Commit

Permalink
[docs] Fix link issue for "Authentication and authorization in Pulsar" (
Browse files Browse the repository at this point in the history
#5764)

* Update security-authorization.md

Fix the link issue #34

see ["Enabling TLS Authentication on Proxies"](security-tls-authentication.md#on-proxies)

* Fixes #5753

Fixes the link for "Enabling TLS Authentication on Proxies".

* Update security-authorization.md
  • Loading branch information
belinda-wong authored and Jennifer88huang-zz committed Dec 3, 2019
1 parent e121108 commit 9137065
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ You can also enable the authorization for the proxy in the proxy configuration f

### Proxy Roles

By default, the broker treats the connection between a proxy and the broker as a normal user connection. The broker authenticates the user as the role configured in `proxy.conf`(see ["Enabling TLS Authentication on Proxies"](security-tls-authentication#on-proxies)). However, when the user connects to the cluster through a proxy, the user rarely requires the authentication. The user expects to be able to interact with the cluster as the role for which they have authenticated with the proxy.
By default, the broker treats the connection between a proxy and the broker as a normal user connection. The broker authenticates the user as the role configured in `proxy.conf`(see ["Enable TLS Authentication on Proxies"](security-tls-authentication.md#enable-tls-authentication-on-proxies)). However, when the user connects to the cluster through a proxy, the user rarely requires the authentication. The user expects to be able to interact with the cluster as the role for which they have authenticated with the proxy.

Pulsar uses *Proxy roles* to enable the authentication. Proxy roles are specified in the broker configuration file, [`conf/broker.conf`](reference-configuration.md#broker). If a client that is authenticated with a broker is one of its ```proxyRoles```, all requests from that client must also carry information about the role of the client that is authenticated with the proxy. This information is called the *original principle*. If the *original principle* misses, the client is not able to access anything.

Expand Down

0 comments on commit 9137065

Please sign in to comment.