seokmo-yoo-dev opened a new pull request, #23394: URL: https://github.com/apache/kafka/pull/23394
### Summary `Sasl.createSaslClient` resolves a `SaslClientFactory` through the JVM-wide security provider registry, and `Security.addProvider` keeps only the first provider registered under a given name. With Kafka loaded in more than one class loader, the registered `OAuthBearerSaslClientProvider` belongs to whichever class loader got there first and cannot cast a callback handler from any other, so only the first application in the process can authenticate. Class loader isolation does not help, because `java.security.Security` is JVM-wide. `OAuthBearerSaslClientFactory` now returns null instead of throwing when the callback handler is not usable, which is what `SaslClientFactory` specifies and which lets `Sasl` try the remaining providers. `SaslClientAuthenticator` then falls back to the factory of its own class loader when the registry yields no client, for the mechanisms Kafka provides itself. The registry is consulted first, so a provider configured through `security.providers` keeps taking precedence, and the fallback only covers a path that fails today with `SaslAuthenticationException`. SCRAM is unaffected: its factory passes the callback handler through without a cast. KAFKA-14102 has the original report and the earlier discussion. ### Testing `OAuthBearerSaslClientTest.createSaslClientReturnsNullForUnusableCallbackHandler` covers the factory contract, and reverting that change makes it fail. `SaslAuthenticatorTest.testSaslClientFromLocalFactory` covers the fallback through the authenticator, including that it returns null for a mechanism Kafka does not provide, so other mechanisms are still left to the registry. ``` ./gradlew :clients:test --tests '*OAuthBearerSaslClientTest' --tests '*SaslAuthenticatorTest' ./gradlew :clients:checkstyleMain :clients:checkstyleTest :clients:spotlessCheck ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
