RivenSun created KAFKA-13751:
--------------------------------
Summary: On the broker side, OAUTHBEARER is not compatible with
other SASL mechanisms
Key: KAFKA-13751
URL: https://issues.apache.org/jira/browse/KAFKA-13751
Project: Kafka
Issue Type: Bug
Components: security
Affects Versions: 3.0.1
Reporter: RivenSun
h1. Phenomenon:
SASL/OAUTHBEARER, whether implemented by default or customized by the user, is
not compatible with other SASL mechanisms.
h3.
case1:
kafka_server_jaas_oauth.conf
{code:java}
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin"
user_admin="admin"
user_alice="alice";
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
org.apache.kafka.common.security.scram.ScramLoginModule required
username="admin"
password="admin_scram";
}; {code}
server.properties
{code:java}
advertised.listeners=SASL_PLAINTEXT://publicIp:8779,SASL_SSL://publicIp:8889,OAUTH://publicIp:8669
listener.security.protocol.map=INTERNAL_SSL:SASL_SSL,PLAINTEXT:PLAINTEXT,SSL:SSL,SASL_PLAINTEXT:SASL_PLAINTEXT,SASL_SSL:SASL_SSL,OAUTH:SASL_SSL
sasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256,SCRAM-SHA-512,OAUTHBEARER{code}
Error when starting kafka:
server.log
{code:java}
[2022-03-16 13:18:42,658] ERROR [KafkaServer id=1] Fatal error during
KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
org.apache.kafka.common.KafkaException: java.lang.IllegalArgumentException:
Must supply exactly 1 non-null JAAS mechanism configuration (size was 3)
at
org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:172)
at kafka.network.Processor.<init>(SocketServer.scala:724)
at kafka.network.SocketServer.newProcessor(SocketServer.scala:367)
at
kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:252)
at
kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:251)
at
kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:214)
at
kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:211)
at
scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
at
scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
at
kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:211)
at kafka.network.SocketServer.startup(SocketServer.scala:122)
at kafka.server.KafkaServer.startup(KafkaServer.scala:266)
at
kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:82)
at kafka.Kafka.main(Kafka.scala)
Caused by: java.lang.IllegalArgumentException: Must supply exactly 1 non-null
JAAS mechanism configuration (size was 3)
at
org.apache.kafka.common.security.oauthbearer.internals.unsecured.OAuthBearerUnsecuredValidatorCallbackHandler.configure(OAuthBearerUnsecuredValidatorCallbackHandler.java:117)
at
org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:139)
... 17 more
[2022-03-16 13:18:42,662] INFO [KafkaServer id=1] shutting down
(kafka.server.KafkaServer)
[2022-03-16 13:18:42,664] INFO [SocketServer brokerId=1] Stopping socket server
request processors (kafka.network.SocketServer) {code}
The default implementation class of oauthbearer's
`sasl.server.callback.handler.class` is
OAuthBearerUnsecuredValidatorCallbackHandler.
In the OAuthBearerUnsecuredValidatorCallbackHandler#configure(...) method, the
jaasConfigEntries parameter is verified.
What I want to say is that {*}the verification logic here is completely
reasonable{*}, but the jaasConfigEntries passed in from the upper layer should
not contain the AppConfigurationEntry of other loginModules. There are several
other codes for the check of the same keyword *"Must supply exactly 1 non-null
JAAS mechanism configuration".*
Rootcause elaborates later.
By the way, at present, KafkaServer allows {*}the same LoginModule to be
configured multiple times in kafkaJaasConfigFile{*}, which will also lead to
the phenomenon of case1.
kafka_server_jaas_oauth.conf eg：
{code:java}
KafkaServer {
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
}; {code}
h3. case2:
On the basis of case1, modify the default implementation of oauthbearer's
`sasl.server.callback.handler.class`
server.properties add new configuration
{code:java}
listener.name.sasl_plaintext.oauthbearer.sasl.server.callback.handler.class=us.zoom.mq.security.oauth.AsyncMQOAuthCallbackHandler
listener.name.sasl_ssl.oauthbearer.sasl.server.callback.handler.class=us.zoom.mq.security.oauth.AsyncMQOAuthCallbackHandler
listener.name.oauth.oauthbearer.sasl.server.callback.handler.class=us.zoom.mq.security.oauth.AsyncMQOAuthCallbackHandler
{code}
The specific implementation class code is omitted here.
When we start kafka again, we still encounter exceptions
server.log
{code:java}
[2022-03-16 14:47:46,037] ERROR Unrecognized SASL Login callback
(org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule)
javax.security.auth.callback.UnsupportedCallbackException: Unrecognized SASL
Login callback
at
org.apache.kafka.common.security.authenticator.AbstractLogin$DefaultLoginCallbackHandler.handle(AbstractLogin.java:105)
at
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.identifyToken(OAuthBearerLoginModule.java:316)
at
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.login(OAuthBearerLoginModule.java:301)
at
java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:726)
at
java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:665)
at
java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:663)
at
java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
at
java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:663)
at
java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:574)
at
org.apache.kafka.common.security.authenticator.AbstractLogin.login(AbstractLogin.java:60)
at
org.apache.kafka.common.security.authenticator.LoginManager.<init>(LoginManager.java:62)
at
org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:112)
at
org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:158)
at
org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:157)
at
org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:97)
at kafka.network.Processor.<init>(SocketServer.scala:724)
at kafka.network.SocketServer.newProcessor(SocketServer.scala:367)
at
kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:252)
at
kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:251)
at
kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:214)
at
kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:211)
at
scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
at
scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
at
kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:211)
at kafka.network.SocketServer.startup(SocketServer.scala:122)
at kafka.server.KafkaServer.startup(KafkaServer.scala:266)
at
kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:82)
at kafka.Kafka.main(Kafka.scala)
[2022-03-16 14:47:46,048] ERROR [KafkaServer id=1] Fatal error during
KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
org.apache.kafka.common.KafkaException:
javax.security.auth.login.LoginException: An internal error occurred while
retrieving token from callback handler
at
org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:172)
at
org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:157)
at
org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:97)
at kafka.network.Processor.<init>(SocketServer.scala:724)
at kafka.network.SocketServer.newProcessor(SocketServer.scala:367)
at
kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:252)
at
kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:251)
at
kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:214)
at
kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:211)
at
scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
at
scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
at
kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:211)
at kafka.network.SocketServer.startup(SocketServer.scala:122)
at kafka.server.KafkaServer.startup(KafkaServer.scala:266)
at
kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:82)
at kafka.Kafka.main(Kafka.scala)
Caused by: javax.security.auth.login.LoginException: An internal error occurred
while retrieving token from callback handler
at
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.identifyToken(OAuthBearerLoginModule.java:319)
at
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.login(OAuthBearerLoginModule.java:301)
at
java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:726)
at
java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:665)
at
java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:663)
at
java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
at
java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:663)
at
java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:574)
at
org.apache.kafka.common.security.authenticator.AbstractLogin.login(AbstractLogin.java:60)
at
org.apache.kafka.common.security.authenticator.LoginManager.<init>(LoginManager.java:62)
at
org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:112)
at
org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:158)
... 17 more
[2022-03-16 14:47:46,049] INFO [KafkaServer id=1] shutting down
(kafka.server.KafkaServer)
[2022-03-16 14:47:46,052] INFO [SocketServer brokerId=1] Stopping socket server
request processors (kafka.network.SocketServer) {code}
By analyzing the stack, it is easy to see the problem:
1) AbstractLogin.login should not call the OAuthBearerLoginModule.login method,
only OAuthBearerRefreshingLogin.login can call the OAuthBearerLoginModule.login
method.
2) OAuthBearerLoginModule.login should not call the
AbstractLogin$DefaultLoginCallbackHandler.handle method, it should call the
OAuthBearerUnsecuredLoginCallbackHandler.handle method.
Analyze the stack, read the source code, the root cause is:
In the ChannelBuilders#create method, if the corresponding JaasContext of each
SASL mechanism is returned by the *JaasContext#defaultContext()* method, the
*JaasContext.configuration* and *JaasContext.configurationEntries* fields both
contain the AppConfigurationEntry of other mechanisms. And then in the
subsequent code stack, resulting in case1 or case2.
In fact, you can find from some source codes of Kafka saslModule that Kafka has
this {*}original intention: JaasContext per saslMechanism should be pure{*}.
1) In the ChannelBuilders#create(...) method, when constructing the
SaslChannelBuilder, `Map<String, JaasContext> jaasContexts` is passed in
2) In the SaslChannelBuilder#configure(...) method, after constructing
LoginManager, LoginManager is also stored with `Map<String, LoginManager>
loginManagers`.
The keys of these two maps are {*}saslMechanism{*}, but their values both
contain all saslMechanism information. Affected by this behavior,
jaasConfigEntries in OAuthBearerUnsecuredValidatorCallbackHandler also contains
other saslMechanism information, other implementation classes of
sasl.server.callback.handler.class have the same problem.
In fact, I have reported an issue a long time ago, and KAFKA-13422 has the same
RC and Solution as this issue.
https://issues.apache.org/jira/browse/KAFKA-13422
For more detailed RC analysis and solutions you can read the last two parts of
the description of KAFKA-13422: Root Cause and Suggestion & Solutions.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
