This message was deleted.

If I don't config

proxyRoles

, when the client connects to the proxy, it will fail with "cannot specify originalPrincipal when connecting without valid proxy role."

You should have three roles: • broker_client(superuser) • proxy(superuser) • client

After a short discussion, my main question is that why the proxy role cannot be equal with a client role (e.g. the super user role). BTW, the solution might be like:

proxyRoles=proxy
superUserRoles=admin,proxy

I haven't looked at this in a bit, but I remember there were several discussion threads on it. https://github.com/apache/pulsar/pull/19455 had some of the discussion and then it went to the mailing list with https://lists.apache.org/thread/q1k1krfjr8njdf8t3sy1ht4vg67s4x71 (general thread) and my final reply here: https://lists.apache.org/thread/7d4fvodhwff3mq2c4n11k8dx2bmqbjcj

Broker client role is a bit confusing. I believe it is more of broker peer?

Broker client role is a bit confusing.

brokerClient

might stand for "the built-in Client in the Broker". Well, the proxy uses the same config, which is confusing.

(general thread) and my final reply here:

Good. I will take a look.