THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
class DescribeDelegationTokenRequest(owner: Set[KafkaPrincipal] )
Protocol changes
DelegationTokenRequest
CreateDelegationTokenRequest
| Code Block |
|---|
CreateDelegationTokenRequest => [Renewer] MaxDateMs Renewer => string MaxDateMs => INT64 |
Field | Description |
|---|---|
Renewer | Renewer is an Kafka PrincipalType+name string, who is allowed to renew this token before the max lifetime expires. If Renewer list is empty, then Renewer will default to the owner (Principal which requested this token). |
MaxDateMs | Max lifetime for the token in milliseconds. If the value is -1, then MaxLifeTime will default to a server side config value (delegation.token.max.lifetime.ms). |
DelegationTokenResponse
CreateDelegationTokenResponse
| Code Block |
|---|
CreateDelegationTokenResponse => ErrorCode TokenDetails
ErrorCode => INT16
TokenDetails => IssueDateMs ExpiryDateMs TokenId HMAC
IssueDateMs => INT64
ExpiryDateMs => INT64
TokenId => String
HMAC => bytes
|
...
* TokenNotFoundException
ExpireTokenRequest
ExpireDelegationTokenRequest
| Code Block |
|---|
ExpireDelegationTokenRequest => HMAC expiryDateMs HMAC => bytes ExpiryDateMs => INT64 |
Field | Description |
|---|---|
HMAC | HMAC of the delegation token to be renewed |
ExpiryDateMs | Expiry time period in milliseconds. If the value is -1, then the token will get invalidated immediately. |
...
ExpireDelegationTokenResponse
| Code Block |
|---|
ExpireDelegationTokenResponse => ErrorCode ErroCode => INT32 ExpiryDateMs => INT64 |
...
* TokenNotFoundException
DescribeTokenRequest
DescribeDelegationTokenRequest
| Code Block |
|---|
DescribeDelegationTokenRequest => [Owner]
Owner => String |
Field | Description |
|---|---|
ErrorCode | |
Owner | Kakfa Principal which requested the delegation token. If the Owner list is null (i.e., length is -1), the response contains all the allowed tokens from all owners. If Owner list is empty, the response is empty list. |
...
DescribeDelegationTokenResponse
| Code Block |
|---|
DescribeDelegationTokenResponse => ErrorCode [TokenDetails]
ErrorCode => INT16
TokenDetails => Owner IssueDateMs ExpiryDateMs TokenId HMAC [Renewer]
Owner => String
IssueDateMs => INT64
ExpiryDateMs => INT64
TokenId => String
HMAC => bytes
Renewer => String
|
...
Token is stored in Zookeeper as properties in the path /tokenauth/tokens/<tokenUID>. S During server startup scram credentials are generated during token creation. We will use password=HMAC, iterations=4096 for scram credential generation.and stored in memory (TokenCache).
| Code Block | ||||
|---|---|---|---|---|
| ||||
//Delegation Token Details for tokenID token123: Zookeeper persistence path /tokenauth/tokens/token123
{
"version":1,
"owner" : "owner",
"renewer" : "renewer",
"issueDateissueTimestamp" : "issueDateissueTimestamp",
"tokenIDmaxTimestamp" : "sequence-numbermaxTimestamp",
//Store SCRAM credentials as per KIP-84
"credentials": {
"SCRAM-SHA-512" : "salt=djR5dXdtZGNqamVpeml6NGhiZmMwY3hrbg==,stored_key=sb5jkqStV9RwPVTGxG1ZJHxF89bqjsD1jT4S...==,server_key=...,iterations=4096",
"SCRAM-SHA-256" : "salt=10ibs0z7xzlu6w5ns0n188sis5,stored_key=+Acl/wi1vLZ95Uqj8rRHVcSp6qrdfQIwZbaZBwM0yvo=,server_key=nN+fZauE6vG0hmFAEj/49+2yk0803y67WSXMYkgh77k=,iterations=4096"
}"expiryTimestamp" : "expiryTimestamp",
"tokenID" : "UUID",
}; |
SCRAM Extensions
SCRAM messages have an optional extensions field which is a comma-separated list of key=value pairs.
After KIP-84 implementation , an extension will be added to the first client SCRAM message to indicate
that authentication is being requested for a delegation token. This will enable Kafka broker to obtain
credentials and principal using a different code path for delegation tokens.
...