[improve][broker] Add strictAuthMethod to require explicit authentication method

[omarkj]

Add a new strictAuthMethod configuration option to enforce that clients must specify their authentication method. When enabled, authentication requests without an explicit method will immediately fail with "Authentication method missing" instead of attempting to authenticate with all configured providers.

This improves security by preventing unintended authentication fallback behaviour when operators want to require specific authentication methods for their deployment.

Main Issue: #25184

• doc
• doc-required
• doc-not-needed
• doc-complete

[github-actions]

@omarkj Please add the following content to your PR description and select a checkbox:

- [ ] `doc` <!-- Your PR contains doc changes -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [ ] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->

[nodece]

LGTM. We just need a PIP for this one before we merge, because this is an important change.

[lhotari]

Thanks for the contribution @omarkj. Yes, a PIP would be useful in documenting the change.

Some questions:

1. does this require also a similar change for

• the Pulsar binary protocol?
• the Pulsar Proxy?

2. Since the client can specify the authentication method, how does this improve security?

• Just wondering if it be useful to limit authentication methods for a particular "advertised listener"?
  • Pulsar broker can bind to multiple addresses/ports and limiting the authentication method for an external port binding could be an useful addition

[omarkj]

I will get a PIP out if relevant.

@lhotari Regarding your questions:

1. does this require also a similar change for

• the Pulsar binary protocol?

I believe the Pulsar Protocol authentication only tries the specified authentication provider unlike the HTTP authentication which iterates through all available providers if none is specified.

• the Pulsar Proxy?

This is a good point, if the proxy is authenticating HTTP requests then yes, might be useful there.

2. Since the client can specify the authentication method, how does this improve security?

This should make it harder to probe the system for possibly misconfigured authentication providers.