litiliu commented on code in PR #3857:
URL: https://github.com/apache/fluss/pull/3857#discussion_r3732995848
##########
fluss-common/src/main/java/org/apache/fluss/security/auth/sasl/plain/PlainServerCallbackHandler.java:
##########
@@ -67,6 +68,16 @@
public class PlainServerCallbackHandler implements AuthenticateCallbackHandler
{
private static final String JAAS_USER_PREFIX = "user_";
private static final String JAAS_IMPERSONATE_PREFIX = "impersonate_";
+
+ /**
+ * The JAAS option prefixes this handler consumes, and the registry the
protocol plugin must
+ * preserve when it regenerates the JAAS config from {@code
security.sasl.plain.credentials}.
+ * Register a new prefix here when this handler starts consuming a new
option; a unit test
+ * asserts the plugin's extraction covers every prefix listed here.
+ */
+ public static final List<String> KNOWN_OPTION_PREFIXES =
Review Comment:
Would it be simpler and more compatible to preserve all options from the
original PlainLoginModule entry instead of maintaining a prefix allowlist?
Since security.sasl.plain.credentials is syntactic sugar, materializing it
should ideally overlay the corresponding user_* options without dropping
unrelated JAAS options. We could parse the single entry through JaasConfig,
copy AppConfigurationEntry#getOptions(), overlay the credentials, and serialize
it safely. This would also avoid exposing and synchronizing
KNOWN_OPTION_PREFIXES.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
