Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

KAFKA-15878: KIP-768 - Extend support for opaque (i.e. non-JWT) tokens in SASL/OAUTHBEARER #14818

Merged
merged 4 commits into from
Mar 1, 2024
Merged

KAFKA-15878: KIP-768 - Extend support for opaque (i.e. non-JWT) tokens in SASL/OAUTHBEARER #14818

merged 4 commits into from
Mar 1, 2024

Conversation

jcme
Copy link
Contributor

@jcme jcme commented Nov 22, 2023

Overview

  • This change pertains to SASL/OAUTHBEARER mechanism of Kafka authentication.
  • Kafka clients can use SASL/OAUTHBEARER mechanism by overriding the custom call back handlers .
  • KIP-768 available from v3.1 further extends the mechanism with a production grade implementation.
  • Kafka's SASL/OAUTHBEARER mechanism currently rejects the non-JWT (i.e. opaque) tokens. This is because of a more restrictive set of characters than what RFC-6750 recommends.
  • This JIRA can be considered an extension of KIP-768 to support the opaque tokens as well apart from the JWT tokens.

Solution

  • Have updated the regex in the the offending class to be compliant with the RFC-6750
  • Have provided a supporting test case that includes the possible character set defined in RFC-6750

philomathanuj and others added 2 commits November 10, 2023 14:19
@philomathanuj
KIP-768: Added support for Opaque tokens by extending the allowed cha…
29af851 
…racter set as per RFC-7650#2.1
@jcme
Merge pull request #1 from philomathanuj/trunk
f57b4ed 
KIP-768: Extend support for opaque (i.e. non-JWT) tokens in SASL/OAUTHBEARER
@kirktrue
Copy link
Contributor

@jcme—I wrote and implemented KIP-768, so I'll take a look at this.

Also, are you able to assign the Jira to yourself? Thanks!

@kirktrue
Copy link
Contributor

@jcme—Can you trigger a rebuild of the CI job? It looks like the last run didn't work.

@omkreddy
Copy link
Contributor

omkreddy commented Feb 24, 2024 •
edited

@jcme Thanks for the PR. Can you pls rebase the PR to latest trunk?

kirktrue
kirktrue approved these changes Feb 26, 2024
View reviewed changes
Copy link
Contributor

@kirktrue kirktrue left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR!

Changes look good to me. Looking at 2.1 of the RFC, those missing characters are a pretty clear omission. Thanks for catching this!

omkreddy
omkreddy approved these changes Mar 1, 2024
View reviewed changes
Copy link
Contributor

@omkreddy omkreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jcme Thanks for the PR. LGTM

@philomathanuj
Copy link
Contributor

Thanks very much @kirktrue, @omkreddy for reviewing the PR. Could you help with merging the PR please?

@omkreddy omkreddy merged commit 52a3fa0 into apache:trunk Mar 1, 2024
1 check failed
clolov pushed a commit to clolov/kafka that referenced this pull request Apr 5, 2024
@jcme @philomathanuj
@cwebbtw @clolov
KAFKA-15878: KIP-768 - Extend support for opaque (i.e. non-JWT) token…
287fcac 
…s in SASL/OAUTHBEARER (apache#14818)

# Overview
* This change pertains to [SASL/OAUTHBEARER ](https://kafka.apache.org/documentation/#security_sasl_oauthbearer)  mechanism of Kafka authentication. 
* Kafka clients can use [SASL/OAUTHBEARER ](https://kafka.apache.org/documentation/#security_sasl_oauthbearer)   mechanism by overriding the [custom call back handlers](https://kafka.apache.org/documentation/#security_sasl_oauthbearer_prod) . 
* [KIP-768](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=186877575) available from v3.1  further extends the mechanism with a production grade implementation. 
* Kafka's [SASL/OAUTHBEARER ](https://kafka.apache.org/documentation/#security_sasl_oauthbearer)  mechanism currently **rejects the non-JWT (i.e. opaque) tokens**. This is because of a more restrictive set of characters than what [RFC-6750](https://datatracker.ietf.org/doc/html/rfc6750#section-2.1) recommends. 
* This JIRA can be considered an extension of [KIP-768](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=186877575) to support the opaque tokens as well apart from the JWT tokens.
 
# Solution
* Have updated the regex in the the offending class to be compliant with the [RFC-6750](https://datatracker.ietf.org/doc/html/rfc6750#section-2.1)
* Have provided a supporting test case that includes the possible character set defined in [RFC-6750](https://datatracker.ietf.org/doc/html/rfc6750#section-2.1)

---------

Co-authored-by: Anuj Sharma <philomath.anuj@gmail.com>
Co-authored-by: Jamie Holmes <jamie.holmes@tesco.com>
Co-authored-by: Christopher Webb <31657038+cwebbtw@users.noreply.github.com>
Reviewers: Manikumar Reddy <manikumar.reddy@gmail.com>, Kirk True <ktrue@confluent.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kirktrue kirktrue kirktrue approved these changes

@omkreddy omkreddy omkreddy approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
5 participants
@jcme @kirktrue @omkreddy @philomathanuj @cwebbtw