nandini12396 opened a new pull request, #22880:
URL: https://github.com/apache/kafka/pull/22880

   ## Summary
   
   - Cache the `KafkaPrincipal` built by `SaslServerAuthenticator` for the 
lifetime of an authenticated connection.
   - Continue to build a new principal after successful SASL re-authentication, 
which installs a new authenticator.
   - Add regression coverage for repeated principal access and 
re-authentication.
   
   ## Motivation
   
   `KafkaChannel.principal()` is consulted while request contexts are 
constructed. The current SASL implementation creates a new 
`SaslAuthenticationContext` and invokes the configured `KafkaPrincipalBuilder` 
on every call, even though the authenticated identity is connection-scoped.
   
   Custom principal builders may perform non-trivial work or have side effects. 
Reusing the principal produced for the authenticated session avoids redundant 
work and ensures repeated access observes the same principal instance.
   
   ## Compatibility
   
   This change introduces no public API or configuration changes. Initial 
authentication behavior is unchanged. During re-authentication Kafka installs a 
new `SaslServerAuthenticator`, so the new authenticated session receives a 
fresh principal.
   
   ## Validation
   
   ```text
   ./gradlew :clients:test --tests 
'org.apache.kafka.common.security.authenticator.SaslAuthenticatorTest'
   ./gradlew spotlessCheck :clients:checkstyleMain :clients:checkstyleTest 
:clients:spotbugsMain -x test
   ```
   
   The test suite covers PLAIN, SCRAM, OAuth bearer, SSL, token authentication, 
and SASL re-authentication paths.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to