[
https://issues.apache.org/jira/browse/KAFKA-20101?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101174#comment-18101174
]
Yunseop Eom commented on KAFKA-20101:
-------------------------------------
PR opened: https://github.com/apache/kafka/pull/23052
Implemented KAFKA-20101 by supporting an explicit * wildcard in
org.apache.kafka.sasl.oauthbearer.allowed.urls. The wildcard is scoped to the
URL allow-list; org.apache.kafka.sasl.oauthbearer.allowed.files remains
exact-match only. Added documentation describing the opt-in and its security
implications.
Validation: TDD RED reproduced the pre-fix failure, then the focused regression
tests passed after the fix. The full ConfigurationUtilsTest and full clients
test passed. Checkstyle, SpotBugs, Spotless, and git diff --check passed.
Status: PR open and awaiting maintainer review; not merged.
> Support org.apache.kafka.sasl.oauthbearer.allowed.urls=*
> --------------------------------------------------------
>
> Key: KAFKA-20101
> URL: https://issues.apache.org/jira/browse/KAFKA-20101
> Project: Kafka
> Issue Type: Improvement
> Components: clients, security
> Affects Versions: 4.1.1
> Reporter: Romain Quinio
> Priority: Major
> Labels: OAuth, OAuth2
>
> With Kafka 4.0.0+ and [https://github.com/apache/kafka/pull/18519,] using
> {{sasl.mechanism=OAUTHBEARER }}requires to whitelist the value of
> {{sasl.oauthbearer.token.endpoint.url}} by setting the Java system property
> {{-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls}} at JVM startup.
> [https://docs.confluent.io/platform/current/security/authentication/sasl/oauthbearer/configure-clients.html]
> mentions {{org.apache.kafka.sasl.oauthbearer.allowed.urls=*}}
> {code:java}
> This property specifies a comma-separated list of allowed IdP JWKS (JSON Web
> Key Set) and token endpoint URLs. Use * (asterisk) as the value to allow any
> endpoint.
> org.apache.kafka.sasl.oauthbearer.allowed.urls=*
> You should consult the specific Kafka client and IdP documentation for the
> exact interpretation and security implications of such a broad setting. {code}
> {{{}{}}}But this configuration doesn't appear to work with kafka-client /
> kafka-streams 4.1.1.
> Debugging the code, the logic is to do an exact match between both strings
> (https://github.com/apache/kafka/blame/74ebbae8ece464573c1288e8f233ef804074fe7b/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/ConfigurationUtils.java#L407).
> It would help to have such mechanism, to avoid duplicating the endpoint URL
> as a system property, which is error-prone. In container-based environments,
> the Kafka client configuration is immutable, and the assumptions of
> CVE-2025-27817 that "Kafka Clients configurations can be specified by an
> untrusted party" are not applicable.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
