[KAFKA-9190] Server leaves connections with expired authentication sessions open

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0, 2.3.0, 2.2.1
• Fix Version/s: 2.4.0, 2.2.3, 2.3.2
• Assignee: Ron Dagostino
• Reporter: Jason Gustafson
• Created: 14/Nov/19 17:44
• Updated: 09/Jan/20 11:15
• Resolved: 04/Dec/19 17:50

Description

SocketServer implements some logic to disconnect connections which have expired authentication sessions. At the moment, we just call `SelectionKey.cancel` in order to trigger this disconnect. I think the expectation is that this causes the channel to be closed on the next `poll`, but as far as I can tell, all it does is disassociate the selection key from the selector. This means that the key never gets selected again and we never close the connection until the client times out.

This was found when debugging the flaky test failure `EndToEndAuthorizationTest.testNoDescribeProduceOrConsumeWithoutTopicDescribeAcl`. I modified the code to call `Selector.close` instead of `TransportLayer.disconnect`. I was able to reproduce the session authentication expiration, but the connection properly closes and the test does no longer times out.

Issue Links

• is cloned by: KAFKA-9264 Reocurrence: Flaky Test DelegationTokenEndToEndAuthorizationTest#testNoDescribeProduceOrConsumeWithoutTopicDescribeAcl
• is cloned by: KAFKA-9187 kafka.api.SaslGssapiSslEndToEndAuthorizationTest.testNoDescribeProduceOrConsumeWithoutTopicDescribeAcl
• links to: GitHub Pull Request #7723