Security

token attaches a JWT to the connection, pulsar+ssl:// dials the TLS listener, and credentials never reach the generated document.

token is Pulsar's token authentication: the client sends the JWT when it connects and when it reconnects. A service reads the token from its environment or its secret store, as the example does.

A pulsar+ssl:// URL dials the server's TLS listener, port 6651 by convention. The client verifies the server's certificate against the system's trusted roots and checks its host name. The connection is TLS from the first byte, so the URL is the whole setting.

A TestApp test runs the same broker in process. It checks the URL as the client parses it, and the token goes nowhere. The generated AsyncAPI document reports the host and the port, and never the token or a user name in the URL.

Connecting to a production cluster takes the service URL and the token from the environment.

Example

The service authenticates with the token in PULSAR_TOKEN and talks to the cluster over TLS.

Macros
Manual

examples/pulsar_broker_security.rs
/// The cluster's TLS listener, authenticated with a JWT.
fn broker(token: &str) -> PulsarBroker {
    PulsarBroker::new("pulsar+ssl://pulsar.acme.internal:6651").token(token)
}

#[ruststream::app]
fn app() -> impl App<State = ()> {
    let token = env::var("PULSAR_TOKEN").unwrap_or_default();
    service(broker(&token))
}

examples/manual/pulsar_broker_security.rs
/// The cluster's TLS listener, authenticated with a JWT.
fn broker(token: &str) -> PulsarBroker {
    PulsarBroker::new("pulsar+ssl://pulsar.acme.internal:6651").token(token)
}

fn app() -> impl App<State = ()> {
    let token = env::var("PULSAR_TOKEN").unwrap_or_default();
    service(broker(&token))
}

Example​

Example