rajinisivaram opened a new pull request, #13211: URL: https://github.com/apache/kafka/pull/13211
We currently cache login managers in static maps for both static JAAS config using system property and for JAAS config specified using Kafka config `sasl.jaas.config`. In addition to the JAAS config, the login manager callback handler is included in the key, but all other configs are ignored. This implementation is based on the assumption clients that require different logins (e.g. username/password) use different JAAS configs, because login properties are included in the JAAS config rather than as separate top-level configs. The OIDC support added in KIP-768 only allows configuration of token endpoint URL as a top-level config. This results in two clients in a JVM configured with different token endpoint URLs to incorrectly share a login. This PR includes all SASL configs prefixed with `sasl.` to be included in the key so that logins are only shared if all the sasl configs are identical. Two rejected approaches: 1) Only include `sasl.oauthbearer.token.endpoint.url` in the key. Rejected because there may be other configs in future for which we want different logins. It may also be useful to have a mechanism to force different logins when using custom configs, `sasl.` prefix would work in general. 2) Include all configs in the key. Kafka brokers create multiple inter-broker clients with different configs, e.g. client.id. We want brokers to create only one login, hence chose a subset based on the `sasl.` prefix. ### Committer Checklist (excluded from commit message) - [ ] Verify design and implementation - [ ] Verify test coverage and CI build status - [ ] Verify documentation (including upgrade notes) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
