Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-21 Thread Ron Dagostino
Thank you, Damian. This concludes the vote for KIP 255. The vote passes with three binding + 1 votes, from Rajini, Jun, and Damian, and three non-binding +1 votes, from Mickael, Manikumar, and myself. I have marked the KIP as "Accepted". The pull request is available at https://github.com/apach

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-21 Thread Damian Guy
+1 (binding) Thanks On Mon, 21 May 2018 at 04:59 Ron Dagostino wrote: > Hi Committers. One more binding affirmative vote is required if KIP 255 > is to have a chance of being included in the 2.0.0 release. Please vote > today. > > Ron > > > On May 18, 2018, at 9:27 PM, Ron Dagostino wrote: >

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-20 Thread Ron Dagostino
Hi Committers. One more binding affirmative vote is required if KIP 255 is to have a chance of being included in the 2.0.0 release. Please vote today. Ron > On May 18, 2018, at 9:27 PM, Ron Dagostino wrote: > > Hi committers. KIP 255 still needs 1 more binding vote. Currently there are >

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-18 Thread Ron Dagostino
Hi committers. KIP 255 still needs 1 more binding vote. Currently there are two binding + 1 votes, from Rajini and Jun, and three non-binding +1 votes, from Mickael, Manikumar, and myself. Please vote by the Monday deadline. Ron On Thu, May 17, 2018 at 10:59 AM, Ron Dagostino wrote: > Hi Jun

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-17 Thread Ron Dagostino
Hi Jun. I've updated the KIP to add a new section titled "Summary for Production Use" that includes this information along with a consolidated set of references to the applicable specifications. Thanks for the questions. *We still need another binding vote* (currently there are two binding + 1 v

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-16 Thread Jun Rao
Hi, Ron, Thanks. I understand now. It may be useful to add a reference to JWT in the KIP. Jun On Tue, May 15, 2018 at 6:51 PM, Ron Dagostino wrote: > Hi Jun. I think you are getting at the fact that OAuth 2 is a flexible > framework that allows different installations to do things differently

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-16 Thread Manikumar
+1 (non-binding) Thanks for the detailed KIP. On Wed, May 16, 2018 at 5:59 PM, Mickael Maison wrote: > Thanks for the KIP, > +1 (non binding) > > On Wed, May 16, 2018 at 2:51 AM, Ron Dagostino wrote: > > Hi Jun. I think you are getting at the fact that OAuth 2 is a flexible > > framework that

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-16 Thread Mickael Maison
Thanks for the KIP, +1 (non binding) On Wed, May 16, 2018 at 2:51 AM, Ron Dagostino wrote: > Hi Jun. I think you are getting at the fact that OAuth 2 is a flexible > framework that allows different installations to do things differently. It > is true that the principal name in Kafka could come

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-15 Thread Ron Dagostino
Hi Jun. I think you are getting at the fact that OAuth 2 is a flexible framework that allows different installations to do things differently. It is true that the principal name in Kafka could come from any claim in the token. Most of the time it would come from the 'sub' claim, but it could cer

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-15 Thread Jun Rao
Hi, Ron, Thanks for the reply. I understood your answers to #2 and #3. For #1, will the server map all clients' principal name to the value associated with "sub" claim? How do we support mapping different clients to different principal names? Jun On Mon, May 14, 2018 at 7:02 PM, Ron Dagostino

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-14 Thread Ron Dagostino
Hi Jun. Thanks for the +1 vote. Regarding the first question about token claims, yes, you have it correct about translating the OAuth token to a principle name via a JAAS module option in the default unsecured case. Specifically, the OAuth SASL Server implementation is responsible for setting th

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-14 Thread Jun Rao
Hi, Ron, Thanks for the KIP. +1 from me. Just a few minor comments below. 1. It seems that we can translate an OAuth token to a principle name through the claim name configured in JASS. However, it's not clear to me how an OAuth token is mapped to a claim. Could you clarify that? 2. The wiki has

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-10 Thread Ron Dagostino
HI again, everyone. Still looking for 2 more binding votes. PR is now available at https://github.com/apache/kafka/pull/4994. Ron On Tue, May 8, 2018 at 9:45 AM, Ron Dagostino wrote: > HI everyone. Can we get 2 more binding votes on this KIP (and non-binding > votes, too)? > > Ron > > On Fri

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-08 Thread Ron Dagostino
HI everyone. Can we get 2 more binding votes on this KIP (and non-binding votes, too)? Ron On Fri, May 4, 2018 at 11:53 AM, Rajini Sivaram wrote: > Hi Ron, > > +1 (binding) > > Thanks for the KIP! > > Regards, > > Rajini > > On Fri, May 4, 2018 at 4:55 AM, Ron Dagostino wrote: > > > Hi everyo

Re: [VOTE] KIP-255: OAuth Authentication via SASL/OAUTHBEARER

2018-05-04 Thread Rajini Sivaram
Hi Ron, +1 (binding) Thanks for the KIP! Regards, Rajini On Fri, May 4, 2018 at 4:55 AM, Ron Dagostino wrote: > Hi everyone. I would like to start the vote for KIP-255: > https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=75968876 > > This KIP proposes to add the following fun