Pulsar Proxy cannot specify originalPrincipal

[lenglet-k]

Hello,

We want our JAVA client to communicate with our brokers via the pulsar proxy.
We use the biscuit authentication plugins: https://github.com/CleverCloud/biscuit-pulsar.

When the configuration is carried out without proxyRoles configured, we get the following error:
Illegal combination of role [biscuit:ROOT_BISCUIT] and originalPrincipal [biscuit:ATTENUATE_BISCUIT]: cannot specify originalPrincipal when connecting without valid proxy role

As soon as you put a proxyRoles in the broker configuration, the original principal is null? Should the proxyRole also be set in the proxy?

Thanks for your help

[Nowadays]

Also interested in this particular issue

[yuweisung]

Is this description not clear?

[lenglet-k]

If that's clear, I'd misunderstood the principle.

[yuweisung]

proxy is a broker client. so you need to set authentication parameters in proxy.conf. the authentication parameters (client id) should match the proxyRole in broker.conf.
Moreover, the real client role (original principal) should not be the same as proxyRole.

[lenglet-k]

Thanks for this answer. A last question, where is the documentation for know the permissions that we can apply on a role ? Because we want attenuate the proxyRole with the less privileges

[brunocascio]

I'm facing this issue only over websockets connection (http and pulsar protocols are fine)

 Illegal combination of role [pulsar-proxy-admin] and originalPrincipal [null]: originalPrincipal must be provided when connecting with a proxy role.