FrankChen021 commented on code in PR #20471:
URL: https://github.com/apache/druid/pull/20471#discussion_r4165641448
##########
extensions-core/kafka-indexing-service/pom.xml:
##########
@@ -67,6 +67,18 @@
</exclusion>
</exclusions>
</dependency>
+ <!-- Provides the AWS_MSK_IAM SASL mechanism; its AWS SDK comes from
druid-aws-common, so no transitives ship. -->
+ <dependency>
+ <groupId>software.amazon.msk</groupId>
+ <artifactId>aws-msk-iam-auth</artifactId>
+ <scope>runtime</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>*</groupId>
Review Comment:
[P2] Default-provider SSO profiles fail at runtime
**Finding:** Both extension POMs exclude every transitive of
aws-msk-iam-auth 2.3.9, but this release's ProfileCredentialsProvider loads
software.amazon.awssdk.services.sso.auth.SsoProfileCredentialsProviderFactory
for profiles using SSO fields and declares the sso and ssooidc modules
explicitly. druid-aws-common in this tree supplies the shared auth, regions,
and STS modules but not those SSO modules, so a user relying on the default AWS
provider chain with an SSO-backed profile cannot resolve credentials and the
Kafka consumer fails before authenticating.
**Suggestion:** Add compatible AWS SDK sso and ssooidc runtime modules to
the shared classpath, or retain these plugin transitives in both extension
packaging paths, and cover an SSO-backed profile in a smoke test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
