Feat[MQB]: Make authentication workflow use plugins #773

emelialei88 · 2025-06-10T18:45:33Z

This PR apply plugin into authentication and reauthentication when we as a broker receives authentication requests from clients.

Added component rawclient to support integration test test_authn.py.
Added plugin bmqauthnbasic for testing. It uses "basic" as mechanism and creates an in-memory map for username and password.
Used plugin to authenticate and reauthenticate.
- Authenticator is managed by TransportManager and referred to by InitialConnectionContext.
- When sending response, we use the same encoding type as the one used by the client AuthenticationRequest.
- Authentication with plugin is performed in a separate thread, and the channel is closed when there's a failure.
- When AuthenticationContext is created during initial connection, create a reauthenticateCb to be called when a client session later receives an AuthenticationEvent.
- Use AuthenticationContext::State to indicate the state of authentication. This is used as to make sure only one authentication is run for a given context, and when a channel closes, no more reauthentication timer will be scheduled.
Default authentication credential:
- Credential = mechanism + identity
- When we receive a ClientIdentity prior to any AuthenticateRequest, we use default credential to authenticate, unless it's explicitly set to Disallow.
- Added AnonyPassAuthenticator (implementing mqbplug::Authenticator) and the corresponding factory and result under mqbauthn as default Authenticator.
A minor refactor to clarify the responsibility
- Have TransportManager instead of InitialConnectionHandler own the Negotiator.
Added a timer to disconnect when the authenticated lifetime expires.
Added InitialConnectionContext::State to indicate the state of initial connection.

src/groups/mqb/mqba/mqba_clientsession.t.cpp

pniedzielski

partial review

src/groups/mqb/mqba/mqba_clientsession.t.cpp

src/integration-tests/test_authn.py

pniedzielski · 2025-07-16T18:59:37Z

src/groups/mqb/mqba/mqba_application.cpp

    STOP_OBJ(d_configProvider_mp, "ConfigProvider");
-    STOP_OBJ(d_statController_mp, "StatController");
    STOP_OBJ(d_authenticationController_mp, "AuthenticationController");
+    STOP_OBJ(d_statController_mp, "StatController");


This and the DESTROY_OBJ change below look important. Is this because we use stats in our auth controller?

Not yet. This change is made since StatController starts first before AuthenticationController, so when stopping I wanted to have them in reverse order.

src/groups/mqb/mqba/mqba_authenticator.cpp

Signed-off-by: Emelia Lei <[email protected]>

dorjesinpo

We may need to revisit the reason for shared_from, see my big comment
Few other comments.

dorjesinpo · 2025-10-09T19:14:59Z

src/groups/mqb/mqba/mqba_authenticator.cpp

+
+    int                                  rc = rc_SUCCESS;
+    bsl::string                          error;
+    mqbnet::InitialConnectionEvent::Enum input;


Suggested change

mqbnet::InitialConnectionEvent::Enum input;

mqbnet::InitialConnectionEvent::Enum event = InitialConnectionEvent::e_ERROR;

And remove all input = InitialConnectionEvent::e_ERROR;

dorjesinpo · 2025-10-09T19:15:20Z

src/groups/mqb/mqba/mqba_authenticator.cpp

+    if (processRc != rc_SUCCESS) {
+        rc    = (processRc * 10) + rc_PROCESS_AUTHENTICATION_FAILED;
+        error = processErrStream.str();
+        input = InitialConnectionEvent::e_ERROR;


Suggested change

input = InitialConnectionEvent::e_ERROR;

dorjesinpo · 2025-10-09T19:50:40Z

src/groups/mqb/mqba/mqba_authenticator.cpp

+
+    // In the case of a default authentication, we do not need to send
+    // an AuthenticationResponse, we just need to continue the negotiation.
+    if (context->state() ==


safer way is to explicitly specify the e_DEFAULT_AUTHENTICATING case as an argument to Authenticator::handleAuthentication and not read the state which the FSM can potentially change.
Or, introduce Authenticator::handleDefaultAuthentication.
Or, make a decision on something other than the state, something immutable. For example, authenticationMsg.
Notice how InitialConnectionContext calls d_authenticator_p->anonymousCredential(), can it be done by the authenticator itself?

dorjesinpo · 2025-10-09T20:17:45Z

src/groups/mqb/mqbnet/mqbnet_authenticationcontext.h

+    /// context.
+    /// It is set during the initial authentication, and is null for
+    /// reauthentication.
+    InitialConnectionContext* d_initialConnectionContext_p;


seems like we do not need it!

dorjesinpo · 2025-10-09T20:33:31Z

src/groups/mqb/mqbnet/mqbnet_authenticationcontext.cpp

+                   << channel->peerUri() << "' [error: " << errorName
+                   << ", code: " << errorCode << "]";
+
+    bmqio::Status status(bmqio::StatusCategory::e_GENERIC_ERROR,


better to use less generic error category (e_CANCELED?)

dorjesinpo · 2025-10-15T19:39:55Z