Hi Ming-Yen
chia_00:
Why does the new handler need to throw an exception when it sees the
unsecuredLogin* configs? Those belong to another handler, so I don’t get the
point of checking them here.
chia_01:
Should OAuthBearerUnsecuredLoginCallbackHandler switch to use warn level
instead of info level?
```java
log.info("Token not provided since n ...
```
Best,
Chia-Ping
On 2026-11-02 02:21 UTC Ming-Yen Chung wrote:
> Hi all,
>
> I would like to start a discussion on
> KIP-1390: Add a tokenless login callback handler for SASL/OAUTHBEARER
> <https://cwiki.apache.org/confluence/x/qAKWGw>
>
> A broker that only validates OAuth tokens does not need its own token, but
> today it relies on the internal OAuthBearerUnsecuredLoginCallbackHandler to
> log in without one. This KIP proposes a new
> OAuthBearerTokenlessLoginCallbackHandler to support tokenless login
> officially.
>
> Best,
> Ming-Yen
>
