[KAFKA-5294] PlainSaslServerFactory should allow a null Map in getMechanismNames

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.10.2.1
• Fix Version/s: 0.11.0.0
• Assignee: Mickael Maison
• Reporter: Bryan Bende
• Created: 19/May/17 14:53
• Updated: 25/Jul/17 11:11
• Resolved: 22/May/17 10:02

Description

PlainSaslServerFactory will get a NullPointerException if getMechanismNames(Map<String,?> props) is called with a null props map.

The Java docs for getMechanismNames from the base class javax.security.sasl.SaslServerFactory say that the map can be null:

• @param props The possibly null set of properties used to specify the
• security policy of the SASL mechanisms.

A scenario where this causes a problem is when attempting to use a Kafka consumer/producer with the PlainLoginModule in the same JVM as a Hadoop client with Kerberos...

The Hadoop client purposely calls getMechanismNames with a null map, so if you have already create a Kafka consumer/producer with PlainLoginModule then the PlainSaslServerFactory will be registered in the list of providers in java.security.Security, and then NPEs when the Hadoop client calls getMechanismNames on each provider with a null map.

Issue Links

• links to: GitHub Pull Request #3105