[KAFKA-8530] Consumer should handle authorization errors in OffsetFetch

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.4.0, 2.3.1
• Component/s: consumer
• Assignee: Jason Gustafson
• Reporter: Jason Gustafson
• Created: 12/Jun/19 22:06
• Updated: 16/Jul/19 14:09
• Resolved: 14/Jun/19 15:16

Description

Found this in a test failure:

10:40:43 kafka.api.PlaintextEndToEndAuthorizationTest > testNoConsumeWithoutDescribeAclViaSubscribe FAILED
10:40:43 java.lang.Exception: Unexpected exception, expected<org.apache.kafka.common.errors.TopicAuthorizationException> but was<org.apache.kafka.common.KafkaException>
10:40:43
10:40:43 Caused by:
10:40:43 org.apache.kafka.common.KafkaException: Unexpected error in fetch offset response for partition e2etopic-0: Not authorized to access topics: [Topic authorization failed.]

The problem is that we are not checking for authorization errors in the offset fetch response. Rather than throwing TopicAuthorizationException, we currently raise a plain KafkaException. The test case works most of the time because we usually see the authorization error when the first Metadata request is sent. It's unclear why that didn't happen here. Possibly there is a race condition setting the initial ACLs.

Issue Links

• links to: GitHub Pull Request #6928