Muralidhar Basani created KAFKA-21438:
-----------------------------------------
Summary: Reuse cached HMAC in DelegationTokenManager.getTokens
Key: KAFKA-21438
URL: https://issues.apache.org/jira/browse/KAFKA-21438
Project: Kafka
Issue Type: Improvement
Components: security
Reporter: Muralidhar Basani
Assignee: Muralidhar Basani
DelegationTokenManager.getTokens() recomputes the HmacSHA512 for every returned
token on each DescribeDelegationToken request. The HMAC is already in
DelegationTokenCache, which stores its Base64 form at insert time.
Proposal: add an accessor to DelegationTokenCache that returns
DelegationTokens, and have getTokens() use it instead of calling
getDelegationToken().
DelegationToken.hmac() returns its internal array, so the accessor must not
hand out the cache's own instances. Instead, build a fresh DelegationToken per
call from the stored Base64 string. Keep the change inside the cache rather
than changing DelegationToken, which is public API.
gh thread: [https://github.com/apache/kafka/pull/24093#issuecomment-6687406871]
related jira https://issues.apache.org/jira/browse/KAFKA-21418
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
