krishvishal opened a new issue, #4510:
URL: https://github.com/apache/iggy/issues/4510
## Summary
The listener speaks plaintext only, so PLAIN passwords cross the network in
clear text. The bridge's own connection to Iggy has no TLS either
(`gateways/kafka/README.md`). A client set to `SSL` or `SASL_SSL` fails during
the handshake. franz-go reports `ErrFirstReadEOF` ("is TLS misconfigured?"),
and kafka-go reports `io.ErrUnexpectedEOF`.
Who hits it:
- Users of managed Kafka services. Azure Event Hubs requires `SASL_SSL`. MSK
requires TLS for SASL. Aiven enables TLS by default and uses client
certificates. Google's managed Kafka authenticates with SASL or mTLS.
- Every KafkaJS SASL example sets `ssl: true`.
If `IGGY_KAFKA_ADVERTISED_HOST` and `IGGY_KAFKA_ADVERTISED_PORT` name a TLS
proxy, that proxy in front of one gateway works today for `SSL` and `SASL_SSL`.
The proxy cannot pass an mTLS identity on.
## Depends on
- the authorization issue for the mTLS identity. Acting as the mapped Iggy
user needs authorization per principal
## Scope
- [ ] Kafka-style listeners: one port per security protocol, each with its
own advertised address. Metadata returns the address of the listener that the
client used
- [ ] TLS through rustls, with certificate reload
- [ ] mTLS that maps the certificate subject to an Iggy user, like Kafka's
`ssl.principal.mapping.rules`
- [ ] TLS on the bridge's connection to Iggy
- [ ] Update `gateways/kafka/docs/AUTHENTICATION.md` and
`gateways/kafka/docs/SCOPE.md`
## Acceptance criteria
- [ ] The Java client, librdkafka and franz-go connect with
`security.protocol=SSL` and with `SASL_SSL`
- [ ] A client certificate maps to the expected Iggy user
- [ ] A reloaded certificate takes effect without a restart
## References
- `gateways/kafka/docs/SCOPE.md`, "TLS on the gateway listener"
- #3930 adds mTLS to Iggy's own transports
- MSK:
https://docs.amazonaws.cn/en_us/AWSCloudFormation/latest/UserGuide/aws-properties-msk-cluster-sasl.html
- Aiven: https://aiven.io/docs/products/kafka/howto/kafka-sasl-auth.html
- Google:
https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/authn-types-kafka
- Azure Event Hubs:
https://learn.microsoft.com/en-us/azure/event-hubs/apache-kafka-configurations
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
