Pulsar security overview

By default, Pulsar configures no encryption, authentication, or authorization. Any client can communicate to Apache Pulsar via plain text service URLs. So we must ensure that Pulsar accessing via these plain text service URLs is restricted to trusted clients only. In such cases, you can use Network segmentation and/or authorization ACLs to restrict access to trusted IPs. If you use neither, the state of cluster is wide open and anyone can access the cluster.

Pulsar supports a pluggable authentication mechanism. And Pulsar clients use this mechanism to authenticate with brokers and proxies. You can also configure Pulsar to support multiple authentication sources.

The broker supports learning whether a particular client supports authentication refreshing. If a client supports authentication refreshing and the credential is expired, the authentication provider calls the refreshAuthentication method to initiate the refreshing process. If a client does not support authentication refreshing and the credential is expired, the broker disconnects the client.

You had better secure the service components in your Apache Pulsar deployment.

Apache Pulsar uses a Authentication Provider to establish the identity of a client and then assign a role token to that client. This role token is then used for to determine what the client is authorized to do.

Authentication providers

Currently Pulsar supports the following authentication providers:

• Kerberos authentication
• HTTP basic authentication