krishvishal opened a new issue, #4512:
URL: https://github.com/apache/iggy/issues/4512
Follow-up to #3549, which shipped PLAIN.
## Summary
PLAIN is the only SASL mechanism. A client set to SCRAM or OAUTHBEARER gets
`UNSUPPORTED_SASL_MECHANISM` (33) and cannot connect. It works only after a
switch to PLAIN, which is a client configuration change.
Who hits it:
- SCRAM: MSK, Aiven (SCRAM-SHA-256 and SCRAM-SHA-512 are on by default once
SASL is on), Strimzi `KafkaUser` resources and Redpanda.
- OAUTHBEARER: Confluent Cloud OAuth, Azure Event Hubs, Strimzi OAuth, and
MSK IAM through signer libraries.
- GSSAPI: Kerberos sites. With SASL on and no `sasl.mechanisms`, librdkafka
picks GSSAPI.
## Open question
`gateways/kafka/docs/AUTHENTICATION.md` ("Why SCRAM is out") rules SCRAM
out. Iggy stores one Argon2 hash per user, and SCRAM needs keys derived with
PBKDF2. Where do SCRAM credentials live: in a replicated credential table in
Iggy, which is a server change, or in a store in the gateway?
## Scope
- [ ] OAUTHBEARER: test the JWT against a JWKS endpoint, with issuer and
audience required, and map a claim to an Iggy user
- [ ] OAUTHBEARER: send `session_lifetime_ms`, so clients authenticate again
before the token expires (KIP-368)
- [ ] SCRAM-SHA-256 and SCRAM-SHA-512 with one salted credential per user,
after the open question is settled
- [ ] DescribeUserScramCredentials (50) and AlterUserScramCredentials (51).
`kafka-configs --add-config SCRAM-SHA-512=...` and the Strimzi User Operator
use them
- [ ] GSSAPI only on request
- [ ] Update `gateways/kafka/docs/AUTHENTICATION.md`
## Acceptance criteria
- [ ] The Java client, librdkafka and franz-go authenticate with OAUTHBEARER
against a test identity provider
- [ ] The same clients authenticate with SCRAM-SHA-256 and SCRAM-SHA-512
- [ ] A client authenticates again before its token expires, and keeps its
connection
## References
- MSK:
https://docs.amazonaws.cn/en_us/AWSCloudFormation/latest/UserGuide/aws-properties-msk-cluster-sasl.html
- Aiven: https://aiven.io/docs/products/kafka/howto/kafka-sasl-auth.html
- Google:
https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/authn-types-kafka
- Azure Event Hubs:
https://learn.microsoft.com/en-us/azure/event-hubs/apache-kafka-configurations
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
