[
https://issues.apache.org/jira/browse/KAFKA-7945?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16771528#comment-16771528
]
ASF GitHub Bot commented on KAFKA-7945:
---------------------------------------
rondagostino commented on pull request #6288: KAFKA-7945: Calc refresh time
correctly when token created in the past
URL: https://github.com/apache/kafka/pull/6288
The token refresh point could potentially be calculated incorrectly when the
token was created far enough in the past, possibly raising an exception and
disabling the client. Typically this is not the case -- when the client
invokes "login" on the JAAS LoginModule the token that is returned is not a
token that has been "sitting on the shelf" for a while; it is generally a token
that has just been created, so its start time is very close to "now". The bug
potentially exists for the case where the token has a start time far enough in
the past such that the 80% point from that start time to the expiration time
ends up being before the current time. Even then, though, the minimum refresh
time will generally kick in and cause the token to be refreshed after that
minimum time. The bug does exist for the special case where not only does the
80% point end up being calculated to be in the past, but also the remaining
lifetime (the time between "now" and the expiration time) is small enough such
that the minimum refresh time and the minimum buffer time at the end cannot
both be accommodated. For example, if the minimum refresh time is 1 minute and
the minimum buffer time at the end is 5 minutes, but the token expires in less
than 6 minutes -- then the bug condition can occur if the token start time is
in the past.
Signed-off-by: Ron Dagostino <[email protected]>
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> ExpiringCredentialRefreshingLogin - timeout value is negative
> -------------------------------------------------------------
>
> Key: KAFKA-7945
> URL: https://issues.apache.org/jira/browse/KAFKA-7945
> Project: Kafka
> Issue Type: Bug
> Affects Versions: 2.0.1
> Reporter: Denis Ogun
> Assignee: Ron Dagostino
> Priority: Major
>
> There was an issue with one of our Kafka consumers no longer sending a valid
> OAuth token. Looking at the logs, there seems to be an error in some of the
> math in the timestamp calculation:
>
> {code:java}
> 14 Feb 2019 06:42:45,694 Expiring credential expires at
> 2019-02-14T06:48:21.000+0000, so buffer times of 60 and 300 seconds at the
> front and back, respectively, cannot be accommodated. We will refresh at
> 2019-02-14T06:01:39.078+0000.
> 14 Feb 2019 06:42:45,694 org.apache.kafka.common.utils.KafkaThread: Uncaught
> exception in thread
> java.lang.IllegalArgumentException: timeout value is negative
> at java.lang.Thread.sleep(Native Method) ~[?:1.8.0_202]
> at org.apache.kafka.common.utils.SystemTime.sleep(SystemTime.java:45)
> ~[kafka-clients-2.x.jar:?]
> at
> org.apache.kafka.common.security.oauthbearer.internals.expiring.ExpiringCredentialRefreshingLogin$Refresher.run(ExpiringCredentialRefreshingLogin.java:86)
> ~[kafka-clients-2.x.jar:?]
> at java.lang.Thread.run(Thread.java:748) [?:1.8.0_202]{code}
>
> At this point the refresh logic would never recover and so the producer
> couldn't consume until we restarted the process.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
