pan3793 opened a new pull request, #58064:
URL: https://github.com/apache/spark/pull/58064
# [SPARK-28173][SS] Support obtaining Kafka delegation token for proxy user
### What changes were proposed in this pull request?
Support obtaining Kafka delegation tokens when the current user is a proxy
user, based on
KAFKA-6945 (Kafka 3.3.0):
- `KafkaTokenUtil.obtainToken` requests the token with
`CreateDelegationTokenOptions.owner(<proxy user>)` when the current UGI is
a proxy user, so the
token is requested with the real user's credentials but owned by the proxy
user. The
`checkProxyUser()` guard that rejected proxy users is removed.
- The two failure modes of the owner-set path are translated into actionable
`SparkException`s:
`UnsupportedVersionException` (broker older than 3.3.0) and
`DelegationTokenAuthorizationException` (real user lacks the
`CreateTokens` operation on the
`User:<proxy user>` resource).
- `printToken` logs the token's REQUESTER alongside OWNER, which differ for
proxy-user tokens.
- The SS Kafka integration guide's caveat is updated: broker version
requirement, the
`kafka-acls.sh` grant example, and the constraint that the real user's
credentials come from the
ticket cache (`--proxy-user` cannot be combined with
`--principal`/`--keytab`) with the token
obtained once and not renewed.
### Why are the changes needed?
Applications submitted with `--proxy-user` cannot use Kafka delegation
tokens: token acquisition
is skipped with a warning, and connectors fall back to other authentication.
KAFKA-6945 added the
ability to create tokens owned by another principal, which makes
impersonation work end to end.
### Does this PR introduce _any_ user-facing change?
Yes. Proxy-user applications now obtain Kafka delegation tokens owned by the
proxy user
(previously acquisition was skipped with a warning). Requires Kafka 3.3.0+
brokers and the real
user granted `CreateTokens` on the `User:<proxy user>` resource;
misconfigurations of either now
fail with a descriptive error.
### How was this patch tested?
UT/IT:
- `KafkaTokenUtilSuite`: `createDelegationTokenOptions` sets the owner for a
proxy user and
leaves it unset otherwise.
- `KafkaDelegationTokenSuite` (embedded secure Kafka + MiniKdc): asserts the
broker-recorded
owner/requester for both the plain and the proxy-user roundtrip; the proxy
roundtrip runs with
DENY read/write ACLs for the real user on the test topic so it passes only
if connectors
authenticate as the proxy user; a negative test asserts the descriptive
error when
`CreateTokens` is not granted.
Real cluster tests:
- Plain token via `KafkaTokenUtil.obtainToken` — → success (token owner
`User:spark`, requester `User:spark`).
- Proxy-user token - `alice` with CreateTokens ACL → success (token owner
`User:alice`).
- Proxy-user token - `bob` without ACL → failure, clean `SparkException: The
real user must be granted the CreateTokens operation on the User:bob
resource.`; broker recorded 0 tokens for `bob`.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Code (claude-fable-5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
