Page History

...

For TLS we would need a separate TLS port for some configuration. Presumably this would need to be maintained in the cluster metadata so clients can choose to connect to the appropriate port.  This needs to be configurable so brokers that do not want to expose an insecure port can do so.

This feature requires some co-operation between the socket server and the api layer. The API layer will handle the authenticate request, but the username will be associated with the connection. One approach to implementing this would be to add the concept of a Session object that is maintained with the connection and contains the username. The session would be stored in the context for the socket in socket server and destroyed as part of socket close. The session would be passed down to the API layer with each request and we would have something like session.authenticatedAs() to get the username to use for authorization purposes. We will also record in the session information about the security level of the connection (does it use encryption? integrity checks?) for use in authorization.

...