[KAFKA-9241] SASL Clients are not forced to re-authenticate if they don't leverage SaslAuthenticateRequest

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0, 2.3.0, 2.2.1, 2.4.0
• Fix Version/s: 2.5.0
• Component/s: clients
• Labels: security security-issue
• Assignee: Ron Dagostino
• Reporter: Ron Dagostino
• Reviewer: Rajini Sivaram
• Created: 27/Nov/19 15:04
• Updated: 17/Apr/20 01:22
• Resolved: 09/Dec/19 18:58

Description

Brokers are supposed to force SASL clients to re-authenticate (and kill such connections in the absence of a timely and successful re-authentication) when SASL Re-Authentication (KIP-368) is enabled via a positive `connections.max.reauth.ms` configuration value. There is a flaw in the logic that causes connections to not be killed in the absence of a timely and successful re-authentication if the client does not leverage the SaslAuthenticateRequest API (which was defined in KIP-152).

Issue Links

• is related to: SPARK-31464 Upgrade Kafka to 2.5.0
• links to: GitHub Pull Request #7784