Uploaded image for project: 'Kafka'
  1. Kafka
  2. KAFKA-14676

Token endpoint URL used for OIDC cannot be set on the JAAS config

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 3.1.2, 3.4.0, 3.2.3, 3.3.2
    • 3.5.0, 3.4.1, 3.3.3
    • security
    • None

    Description

      Kafka allows multiple clients within a JVM to use different SASL configurations by configuring the JAAS configuration in `sasl.jaas.config` instead of the JVM-wide system property. For SASL login, we reuse logins within a JVM by caching logins indexed by their sasl.jaas.config. This relies on login configs being overridable using `sasl.jaas.config`.

      KIP-768 (https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=186877575) added support for OIDC for SASL/OAUTHBEARER. The token endpoint used to acquire tokens can currently only be configured using the Kafka config `sasl.oauthbearer.token.endpoint.url`. This prevents different clients within a JVM from using different URLs. We need to either provide a way to override the URL within `sasl.jaas.config` or include more of the client configs in the LoginMetadata used as key for cached logins.

      Attachments

        Issue Links

          Activity

            People

              rsivaram Rajini Sivaram
              rsivaram Rajini Sivaram
              Manikumar Manikumar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: