[Q/A] (Dubbo version 3.3.1) Where can I find an example of using the Auth plugin?

[mitpjones]

Pre-check

• I am sure that all the content I provide is in English.

Apache Dubbo Component

Java SDK (apache/dubbo)

Details

Where can I find an example of using the Auth plugin ?

I can not find any documentation that describes how to use/configure the plugin apart from https://dubbo.apache.org/en/overview/mannual/java-sdk/reference-manual/protocol/tripe-rest-manual/ and https://dubbo.apache.org/en/overview/mannual/java-sdk/tasks/security/auth/

I have tried to configure the BasicAuthenticator with partial success(1) and also the AccessKeyAuthenticator with little success.

I can also see there there is a package called org.apache.dubbo.auth.v1alpha1 which makes me think that some of the functionality may not yet be complete?

1. If the producer is configured with

  provider:   
    auth: true   
    authenticator: basic   
    username: admin     
    password: admin

then the service IS still accessible if the consumer is configured as

  consumer:   
    auth: true   

maybe a bug?

However will be denied if configured and the username/password is different e.g.

  consumer:   
    auth: true   
    authenticator: basic   
    username: xyz     
    password: xyz

Thanks,

Tim

Code of Conduct

• I agree to follow this project's Code of Conduct

[zrlw]

password: admin

change it and test again?

[zrlw]

password: admin

change it and test again?

i mean change your provide password.

[mitpjones]

I have changed the provider password as follows

  provider:
    auth: true
    username: admin
    password: notadmin
    authenticator: basic

the consumer is commented out as follows

  #consumer:
   #auth: true
   #username: admin
   #password: notadmin

but the call from the consumer to the provider is still successfull

Wed Aug 06 07:32:39 NZST 2025 Receive result ======> Hello world

I would expect the call to fail as I have configured the provider with auth: true

When debugging the BasicAuthenticator.sign() method I can see that when the consumer has commented out the auth configuration as above that it (incorrectly) gets and uses the providers username/password (admin/notadmin) from the url (the fact that the provider has some how exposed it's password is concerning).

But when the consumer has the auth configured it will correctly use the use the consumers username/password.

So I think

1. the code needs to be modified so that the provider never exposes it's username and password and
2. the BasicAuthenticator.sign() method always uses the consumers auth configuration

[mitpjones]

Sorry, I think you may have misunderstood.

1. When the provider is configured with the following

  provider:   
    auth: true   
    authenticator: basic   
    username: admin     
    password: admin

it will allow a consumer configured with

  consumer:
   auth: true
   #username: admin
   #password: notadmin

to make a call. I think the consumer should be denied in this case as no username or password has been set.

However if the consumer is configured as

  consumer:
   auth: true
   username: admin
   password: notadmin

it will fail as expected with

StatusRpcException: UNAUTHENTICATED : Forbid invoke remote service interface org.apache.dubbo.springboot.demo.DemoService method sayHello() from consumer /172.28.5.128:44666 to provider 172.28.5.128

[zrlw]

i don't reproduce your issue by adding auth configurations to dubbo-samples-dubbo of https://github.com/apache/dubbo-samples, could you push your provider and consumer project to your repos? i doubt your consumer project shares your provider configuration.

[zrlw]

you should separate consumer project from provider project.

[mitpjones]

I am using the apache-dubbo/example/dubbo-samples/1-basic/dubbo-samples-spring-boot example

I have followed the README. After pasting

  provider:
    auth: true
    username: admin
    password: notadmin
    authenticator: basic

in to the Provider's application.yml.

If I call

curl \
    --header "Content-Type: application/json" \
    --data '["Dubbo"]' \
    http://localhost:50052/org.apache.dubbo.springboot.demo.DemoService/sayHello/

I get the expected

{"message":"Forbid invoke remote service interface org.apache.dubbo.springboot.demo.DemoService method sayHello() from consumer /127.0.0.1:39596 to provider 172.28.100.101","status":"401"}

However if I start the Consumer

 mvn compile exec:java -Dexec.mainClass="org.apache.dubbo.springboot.demo.consumer.ConsumerApplication"

I get

[INFO] Scanning for projects...
[INFO] 
[INFO] --------< org.apache.dubbo:dubbo-samples-spring-boot-consumer >---------
[INFO] Building dubbo-samples-spring-boot-consumer 1.0-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
.
.
.
08:52:38.069 |-INFO  [org.apache.dubbo.springboot.demo.consumer.ConsumerApplication.main()] ngboot.demo.consumer.ConsumerApplication:56  -| Started ConsumerApplication in 2.455 seconds (process running for 4.112)
Receive result ======> Hello world
08:52:38.130 |-INFO  [pool-2-thread-1] .event.AwaitingNonWebApplicationListener:179 -|  [Dubbo] Current Spring Boot Application is await...
Mon Aug 11 08:52:39 NZST 2025 Receive result ======> Hello world
Mon Aug 11 08:52:40 NZST 2025 Receive result ======> Hello world

Why is the consumer not forbidden?

[zrlw]

it seemed that the triple server doesn't check client auth infos when client sent requests using dubbo protocol, could you submit a issue at https://github.com/apache/dubbo/issues ?

[mitpjones]

thanks for checking. Done #15630

Do you have any news/examples about the AccessKeyAuthenticator or is that still work in progress?