muralibasani opened a new pull request, #23557: URL: https://github.com/apache/kafka/pull/23557
Ref : https://issues.apache.org/jira/browse/KAFKA-21143 Problem : when the JAAS module options were empty - a broker that only validates OAUTHBEARER tokens, relies on the tokenless login path from KAFKA-7462, which OAuthBearerUnsecuredLoginCallbackHandler took only. JAAS options also carry the ssl.* settings for the JWKS endpoint client (KIP-768), so configuring JWKS TLS trust made the handler try to mint an unsecured token with no "sub" claim and failed broker startup. Fix : The handler now creates an unsecured token only when an option with the "unsecuredLogin" prefix is present; other options fall through to the tokenless login. OAuthBearerLoginModule also chains the callback handler's exception into the LoginException, so the root cause is visible. Before the fix, production users had two workarounds: - Add unsecuredLoginStringClaim_sub="...", so a production broker creates a throwaway unsigned token just to start. It's harmless, but awkward to explain in a security review. - Put the identity provider's CA in the JVM-wide truststore, which then affects every TLS connection in the broker. Manually verified: a broker with an Entra JWKS endpoint and ssl.truststore.* JAAS options fails on 4.2.0 and starts with this patch. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
