Lianet Magrans created KAFKA-21198:
--------------------------------------
Summary: Consider improving client-side visibility/logging for
rejected Oauth token
Key: KAFKA-21198
URL: https://issues.apache.org/jira/browse/KAFKA-21198
Project: Kafka
Issue Type: Task
Components: clients
Reporter: Lianet Magrans
Assignee: Evan Zhou
The current los when an issue with the token leads to fail auth does not
include anything to help identify the token, which makes it hard to correlate
to the broker-side when a token is rejected.
Current client-side logging on token-related failure seems to be around
principal only (debug level) here
[https://github.com/apache/kafka/blob/7aba83304c69e151597ecfb4e8a004079cdd1ec8/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/OAuthBearerRefreshingLogin.java#L106]
and nothing is logged where I expect the token failure on the related incident
would land on the client side
[https://github.com/apache/kafka/blob/7aba83304c69e151597ecfb4e8a004079cdd1ec8/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/OAuthBearerSaslClient.java#L100]
This task is to review if logging could be improved (considering from the
security pov, what would be helpful and acceptable to log)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
