This message was deleted.
# generals
Slackbot
08/22/2023, 2:02 PMThis message was deleted.
y
Yu Wei Sung
08/22/2023, 2:28 PMIn your case (token/pulsar authorization), subject is JWT token term and role is pulsar authorization term. It is authorization plugin’s job to define how to translate token subject to pulsar role.
Yu Wei Sung
08/22/2023, 2:29 PMthe default one is just 1:1 mapping. subject = role.
j
jacek_placek
08/22/2023, 2:50 PMoch I see, thank you. In that case should token generated for subject "testsubject" be defined in proxy config as proxyroles: testsubject ? or should that work regardless as long as there's proper permission set at namespace level ? I think I've tested both though, just trying to figure out which part I might have misconfigured
y
Yu Wei Sung
08/22/2023, 2:57 PMproxy config just set the “init” admin role. to setup different roles for tenant/namespace/topic/function, you can use pulsarctl/pulsar admin to grant non-admin roles (consume/produce/function….). Those roles are recorded in metadata, not in config.
j
jacek_placek
08/23/2023, 6:26 AMthank you 🙂
jacek_placek
08/23/2023, 12:38 PMwould you might commenting on the following too ?
Copy code
Illegal combination of role [proxyadmin] and originalPrincipal [jacek]: cannot specify originalPrincipal when connecting without valid proxy role.y
Yu Wei Sung
08/23/2023, 6:05 PMwhat’s the auth.superUsers.proxy in your helmchart value?
j
jacek_placek
08/24/2023, 9:22 AMI think we were able to get it, currently we have adminproxy, that's listed in proxyroles on broker conf and it kinda works while interacting as a different subject with related topics
👍 1