nandini12396 opened a new pull request, #22880: URL: https://github.com/apache/kafka/pull/22880
## Summary - Cache the `KafkaPrincipal` built by `SaslServerAuthenticator` for the lifetime of an authenticated connection. - Continue to build a new principal after successful SASL re-authentication, which installs a new authenticator. - Add regression coverage for repeated principal access and re-authentication. ## Motivation `KafkaChannel.principal()` is consulted while request contexts are constructed. The current SASL implementation creates a new `SaslAuthenticationContext` and invokes the configured `KafkaPrincipalBuilder` on every call, even though the authenticated identity is connection-scoped. Custom principal builders may perform non-trivial work or have side effects. Reusing the principal produced for the authenticated session avoids redundant work and ensures repeated access observes the same principal instance. ## Compatibility This change introduces no public API or configuration changes. Initial authentication behavior is unchanged. During re-authentication Kafka installs a new `SaslServerAuthenticator`, so the new authenticated session receives a fresh principal. ## Validation ```text ./gradlew :clients:test --tests 'org.apache.kafka.common.security.authenticator.SaslAuthenticatorTest' ./gradlew spotlessCheck :clients:checkstyleMain :clients:checkstyleTest :clients:spotbugsMain -x test ``` The test suite covers PLAIN, SCRAM, OAuth bearer, SSL, token authentication, and SASL re-authentication paths. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
