bharathgunapati commented on code in PR #58:
URL:
https://github.com/apache/flink-connector-http/pull/58#discussion_r4545592182
##########
docs/content.zh/docs/connectors/datastream/http.md:
##########
@@ -71,6 +71,14 @@ These options are specified on the builder using the
setProperty method.
| http.security.cert.client | optional | Path
to trusted certificate that should be used by connector's HTTP client for mTLS
communication.
|
| http.security.key.client | optional | Path
to trusted private key that should be used by connector's HTTP client for mTLS
communication.
|
| http.security.cert.server.allowSelfSigned | optional |
Accept untrusted certificates for TLS communication.
|
+| http.security.oidc.token.request | optional | OIDC
`Token Request` body in `application/x-www-form-urlencoded` encoding. Required
when `http.security.oidc.token.endpoint.url` is configured.
|
+| http.security.oidc.token.endpoint.url | optional | OIDC
`Token Endpoint` URL to which the token request will be issued. When set, every
sink request gets an `Authorization: Bearer <token>` header with a cached token
that is refreshed when it expires; this replaces any configured
`http.sink.header.Authorization`.
|
+| http.security.oidc.token.expiry.reduction | optional | OIDC
tokens will be requested if the current time is later than the cached token
expiry time minus this value. The default is `30s`.
|
+| http.sink.http-version | optional |
Version of HTTP to use for sink HTTP requests. Valid values are `HTTP_1_1` and
`HTTP_2`. The default is `HTTP_1_1`.
|
+| http.sink.proxy.host | optional |
Hostname of the proxy used by the sink HTTP client.
|
+| http.sink.proxy.port | optional | Port
of the proxy used by the sink HTTP client.
|
+| http.sink.proxy.username | optional |
Username used for sink proxy authentication.
|
Review Comment:
Yeah, Basic. The sink reuses the lookup side's ProxyConfig, which registers a
java.net.Authenticator; the JDK HttpClient answers the proxy's 407 challenge
with
`Proxy-Authorization: Basic <base64(user:password)>`. Basic is the only
scheme the
JDK HttpClient's AuthenticationFilter implements, so Digest/NTLM/Negotiate
proxies
are not supported, same as for the existing lookup proxy options.
One caveat, now in the docs: for an https sink endpoint the request is
tunnelled
with CONNECT, and the JDK disables Basic for tunnels by default
(`jdk.http.auth.tunneling.disabledSchemes=Basic` in conf/net.properties).
Users
need `-Djdk.http.auth.tunneling.disabledSchemes=` on the task managers for
proxy
auth to work with https targets.
I reworded the two sink proxy rows to say this explicitly (d4df118, also
rebased
onto main). The lookup proxy rows have the same gap; I left them for a
follow-up to
keep this PR on the sink.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
