Oauthbearer support

[uwburn]

#674

Implemented the SASL OAUTHBEARER request, the reauthentication mechanism seems to be handled automatically by already present isConnected() check in src/broker/index.js, as it evalueates the sessionLifetime that is replied back from Kafka when proper options (connections.max.reauth.ms) are configured in the broker.

A base spec ha been introduced to check the most obvious errors, more elaborate testing seems difficult to set up, as requires plenty of configuration on the broker.

Some tests are failing, but they do seem unrelated.

Updates to the documentation are missing at the moment.

[uwburn]

I wrote a test using for OAUTHBEARER login, but the problem is that Kafka fails to start with exception java.lang.IllegalArgumentException: Must supply exactly 1 non-null JAAS mechanism configuration (size was 3) when configured to use the embedded OAUTHBEARER handler.

Unfortunately i found other users having the same issue, by looking at the Java class at https://github.com/apache/kafka/blob/b8651d4e82d45463d2c71798bd5852f8a605b440/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/unsecured/OAuthBearerUnsecuredValidatorCallbackHandler.java it looks like it doesn't properly lookup the JAAS entry but just checks that there's only one and pick it, so it gets confused by PLAN and SCRAM entries. I also tried declaring a dedicated listener for the test but it still refuse to start with the same error.

I opened a branch oauthbearer-support-test in my fork if you want to check it. From it you can manually check that it works, but you have to remove non OAUTHBEARER SASL mechanisms and remove non OAUTHBEARER entries from KafkaServer JAAS section. Should i include the test keeping it commented, in case in future we can use it?

In the meantime i added the docs.

[uwburn]

Do you have any plan for merging the PR and having the funcionality available in GA releases?

[uwburn]

Rebased.

[Nevon]

Do you have any plan for merging the PR and having the funcionality available in GA releases?

Sorry about the delay. It seems all the maintainers, including myself, are busy with life and work lately.

Should i include the test keeping it commented, in case in future we can use it?

I think that sounds good, but rather than commenting it out, let's do what we do for running tests with different versions of Kafka:

kafkajs/testHelpers/index.js

Lines 193 to 199 in b13567d

	const testIfKafkaVersion = version => (description, callback, testFn = test) => {
	return semver.gte(semver.coerce(process.env.KAFKA_VERSION), semver.coerce(version))
	? testFn(description, callback)
	: test.skip(description, callback)
	}
	const testIfKafka_0_11 = testIfKafkaVersion('0.11')

So something like:

const testIfEnv = (key, value) => (description, callback, testFn = test) => {
  return value === process.env[key]
    ? testFn(description, callback)
    : test.skip(description, callback)
}

/**
 *  <Explanation why oauthbearer is conditionally enabled and how to enable it>
 */
const testIfOauthbearerEnabled = testIfEnv('OAUTHBEARER_ENABLED', '1')

Then you test would be just the following, and it would run if OAUTHBEARER_ENABLED is 1, and be skipped otherwise.

testIfOauthbearerEnabled('support SASL OAUTHBEARER connections', async () => {
  // ...
})

[uwburn]

Sorry about the delay. It seems all the maintainers, including myself, are busy with life and work lately.

Sorry, i was not meaning to be harsh, i am about to start a project in the company where i work that would include kafkajs, so i'm looking forward to avoid using git npm dependencies, but that's not really an issue.

Anyway, i followed your suggestion, also i rearranged a bit SASL tests to avoid code duplications.

By looking at it i noted that probably some other conditional tests about 1.1 and 0.11 must be rechecked, if i have some time to spare eventually i will submit another PR about that.

[Nevon]

I added a job to the pipeline that runs the Oauthbearer tests. It's configured to only run in master, as it takes more than 5 minutes to search through all tests for the SASL OAUTHBEARER ones. Not great, and could be fixed by reorganizing the tests so that all the oauthbearer ones are in files with a certain suffix or something, but I'm not gonna do that right now. I did run the job through CI once, and it passed.