Major Description
We need to make sure that code related to the internal delegation tokens implementation doesn't have any impact on public interfaces, including customizable callback handlers from KIP-86.
- KafkaPrincipal has a public tokenAuthenticated() method. Principal builders are configurable and we now expect custom principal builders to set this value. Since we allow the same endpoint to be used for basic SCRAM and delegation tokens, the configured principal builder needs a way of detecting token authentication. Default principal builder does this using internal SCRAM implementation code. It will be better if configurable principal builders didn't have to set this flag at all.
- It will be better to replace o.a.k.c.security.scram.DelegationTokenAuthenticationCallback with a more generic ScramExtensionsCallback. This will allow us to add more extensions in future and it will also enable custom Scram extensions.
- ScramCredentialCallback was extended to add tokenOwner and mechanism. Mechanism is determined during SASL handshake and shouldn't be configurable in a callback handler. ScramCredentialCallback is being made a public interface in KIP-86 with configurable callback handlers. Since delegation token implementation is internal and not extensible, tokenOwner should be in a delegation-token-specific callback.
Attachments
Issue Links
- links to