seokmo-yoo-dev opened a new pull request, #23394:
URL: https://github.com/apache/kafka/pull/23394

   ### Summary
   
   `Sasl.createSaslClient` resolves a `SaslClientFactory` through the JVM-wide
   security provider registry, and `Security.addProvider` keeps only the first
   provider registered under a given name. With Kafka loaded in more than one 
class
   loader, the registered `OAuthBearerSaslClientProvider` belongs to whichever
   class loader got there first and cannot cast a callback handler from any 
other,
   so only the first application in the process can authenticate. Class loader
   isolation does not help, because `java.security.Security` is JVM-wide.
   
   `OAuthBearerSaslClientFactory` now returns null instead of throwing when the
   callback handler is not usable, which is what `SaslClientFactory` specifies 
and
   which lets `Sasl` try the remaining providers. `SaslClientAuthenticator` then
   falls back to the factory of its own class loader when the registry yields no
   client, for the mechanisms Kafka provides itself.
   
   The registry is consulted first, so a provider configured through
   `security.providers` keeps taking precedence, and the fallback only covers a
   path that fails today with `SaslAuthenticationException`. SCRAM is 
unaffected:
   its factory passes the callback handler through without a cast.
   
   KAFKA-14102 has the original report and the earlier discussion.
   
   ### Testing
   
   
`OAuthBearerSaslClientTest.createSaslClientReturnsNullForUnusableCallbackHandler`
   covers the factory contract, and reverting that change makes it fail.
   `SaslAuthenticatorTest.testSaslClientFromLocalFactory` covers the fallback
   through the authenticator, including that it returns null for a mechanism 
Kafka
   does not provide, so other mechanisms are still left to the registry.
   
   ```
   ./gradlew :clients:test --tests '*OAuthBearerSaslClientTest' --tests 
'*SaslAuthenticatorTest'
   ./gradlew :clients:checkstyleMain :clients:checkstyleTest 
:clients:spotlessCheck
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to