package org.apache.kafka.common.security.oauthbearer;

/**
 * The <code>b64token</code> value as defined in
 * <a href="https://tools.ietf.org/html/rfc6750#section-2.1">RFC 6750 Section
 * 2.1</a> along with the token's specific scope and lifetime and principal
 * name.
 * <p>
 * A network request would be required to re-hydrate an opaque token, and that
 * could result in (for example) an {@code IOException}, but retrievers for
 * various attributes ({@link #scope()}, {@link #lifetimeMs()}, etc.) declare no
 * exceptions. Therefore, if a network request is required for any of these
 * retriever methods, that request could be performed at construction time so
 * that the various attributes can be reliably provided thereafter. For example,
 * a constructor might declare {@code throws IOException} in such a case.
 * Alternatively, the retrievers could throw unchecked exceptions.
 *
 * @see <a href="https://tools.ietf.org/html/rfc6749#section-1.4">RFC 6749
 *      Section 1.4</a> and
 *      oauthbearer;

/**
 * The <code>b64token</code> value as defined in
 * <a href="https://tools.ietf.org/html/rfc6750#section-2.1">RFC 6750 Section
 * 2.1</a> along with the token's specific scope and lifetime and principal
 * name.
 * <p>
 * A network request would be required to re-hydrate an opaque token, and that
 * could result in (for example) an {@code IOException}, but retrievers for
 * various attributes ({@link #scope()}, {@link #lifetime()}, etc.) declare no
 * exceptions. Therefore, if a network request is required for any of these
 * retriever methods, that request could be performed at construction time so
 * that the various attributes can be reliably provided thereafter. For example,
 * a constructor might declare {@code throws IOException} in such a case.
 * Alternatively, the retrievers could throw unchecked exceptions.
 *
 * @see <a href="https://tools.ietf.org/html/rfc6749#section-1.4">RFC 6749
 *      Section 1.4</a> and
 *      <a href="https://tools.ietf.org/html/rfc6750#section-2.1">RFC 6750
 *      Section 2.1</a>
 */
public interface OAuthBearerToken {
    /**
     * The <code>b64token</code> value as defined in
     * <a href="https://tools.ietf.org/html/rfc6750#section-2.1">RFC 6750 Section
     * 2.1</a>
     *
     * @return <code>b64token</code> value as defined in
     *         <a href="https://tools.ietf.org/html/rfc6750#section-2.1">RFC 6750
     *         Section 2.1</a>
     */
    String value();

    /**
     * The token's scope of access, as per
     * <a href="https://tools.ietf.org/html/rfc6749#section-1.4">RFC 6749 Section
     * 1.4</a>
     *
     * @return the token's (always non-null but potentially empty) scope of access,
     *         as per <a href="https://tools.ietf.org/html/rfc6749#section-1.4">RFC
     *         6749 Section 1.4</a>. Note that all values in the returned set will
     *         be trimmed of preceding and trailing whitespace, and the result will
     *         never contain the empty string.
     */
    Set<String> scope();

    /**
     * The token's lifetime, expressed as the number of milliseconds since the
     * epoch, as per <a href="https://tools.ietf.org/html/rfc6749#sectionrfc6750#section-2.1.4">RFC 6750
 *    * 6749 Section 12.4<1</a>
 */
public interface OAuthBearerToken {
    /**
     * @returnThe the token'slifetime, expressed as the number of milliseconds since<code>b64token</code> value as defined in
     * <a href="https://tools.ietf.org/html/rfc6750#section-2.1">RFC 6750 Section
     * 2.1</a>
     *
    the epoch, * @return <code>b64token</code> value as defined perin
     *         <a href="https://tools.ietf.org/html/rfc6749#sectionrfc6750#section-2.1.4">RFC 67496750
     *         Section 12.4<1</a>.
     */
    longString lifetimevalue();

    /**
     * The token's namescope of theaccess, principal to which this credential appliesas per
     *
     * @return the always non-null/non-empty principal name<a href="https://tools.ietf.org/html/rfc6749#section-1.4">RFC 6749 Section
     * 1.4</a>
    String principalName();

    /**
     * When@return the credential became valid, in terms of the number of millisecondstoken's (always non-null but potentially empty) scope of access,
     * since the epoch, if known, otherwise null. An expiringas credentialper may not
     * necessarily indicate when it was created -- just when it expires -- so we
     * need to support a null return value here.<a href="https://tools.ietf.org/html/rfc6749#section-1.4">RFC
     *         6749 Section 1.4</a>. Note that all values in the returned set will
     *
     * @return the time whenbe thetrimmed credentialof becamepreceding valid,and intrailing termswhitespace, ofand the numberresult ofwill
     *         millisecondsnever sincecontain the epoch, if known, otherwise nullempty string.
     */
    LongSet<String> startTimeMillisscope();
}

package org.apache.kafka.common.security.oauthbearer;



    /**
 * The {@code LoginModule} for* the SASL/OAUTHBEARER mechanism.
 */
public class OAuthBearerLoginModule implements LoginModule {
    static {
        OAuthBearerSaslClientProvider.initialize(); // not part of public APIThe token's lifetime, expressed as the number of milliseconds since the
     * epoch, as per <a href="https://tools.ietf.org/html/rfc6749#section-1.4">RFC
     * 6749 Section 1.4</a>
     *
     * @return  OAuthBearerSaslServerProvider.initialize(); // not partthe token'slifetime, expressed as the number of publicmilliseconds API
    }

    // etc...
}

package org.apache.kafka.common.security.oauthbearer;

/**
 * The {@code LoginModule} for the SASL/OAUTHBEARER mechanism. When a client
 * (whether a non-broker client or a broker when SASL/OAUTHBEARER is the
 * inter-broker protocol) connects to Kafka the {@code OAuthBearerLoginModule}
 * instance asks its configured {@link AuthenticateCallbackHandler}
 * implementation to handle an instance of {@link OAuthBearerTokenCallback} and
 * return an instance of {@link OAuthBearerToken}. A default, builtin
 * {@link AuthenticateCallbackHandler} implementation creates an unsecured token
 * as defined by these JAAS module options:
 * <table>
 * <tr>
 * <th>JAAS Module Option for Unsecured Token Retrieval</th>
 * <th>Documentation</th>
 * </tr>
 * <tr>
 * <td>{@code unsecuredLoginStringClaim_<claimname>="value"}</td>
 * <td>Creates a {@code String} claim with the given name and value. Any valid
 * claim name can be specified except '{@code iat}' and '{@code exp}' (these are
 * automatically generated).</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredLoginNumberClaim_<claimname>="value"}</td>
 * <td>Creates a {@code Number} claim with the given name and value. Any valid
 * claim name can be specified except '{@code iat}' and '{@code exp}' (these are
 * automatically generated).</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredLoginListClaim_<claimname>="value"}</td>
 * <td>Creates a {@code String List} claim with the given name and values parsed
 * from the given value where the first character is taken as the delimiter. For
 * example: {@code unsecuredLoginListClaim_fubar="|value1|value2"}. Any valid
 * claim name can be specified except '{@code iat}' and '{@code exp}' (these are
 * automatically generated).</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredLoginPrincipalClaimName}</td>
 * <td>Set to a custom claim name if you wish the name of the String claim
 * holding the principal name to be something other than '{@code sub}'.</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredLoginLifetimeSeconds}</td>
 * <td>Set to an integer value if the token expiration is to be set to something
 * other than the default value of 3600 seconds (which is 1 hour). The
 * '{@code exp}' claim will be set to reflect the expiration time.</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredLoginScopeClaimName}</td>
 * <td>Set to a custom claim name if you wish the name of the String or String
 * List claim holding any token scope to be something other than
 * '{@code scope}'.</td>
 * </tr>
 * </table>
 * Production use cases will require writing an implementation of
 * {@link AuthenticateCallbackHandler} that can handle an instance of
 * {@link OAuthBearerTokenCallback} and declaring it via either the
 * {@code sasl.login.callback.handler.class} configuration option for a
 * non-broker client or via the
 * {@code listener.name.sasl_ssl.oauthbearer.sasl.login.callback.handler.class}
 * configuration option for brokers (when SASL/OAUTHBEARER is the inter-broker
 * protocol).
 * <p>
 * Here is a typical, basic JAAS configuration for a client leveraging unsecured
 * SASL/OAUTHBEARER authentication:
 *
 * <pre>
 * KafkaClient {
 *      org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule Required
 *      unsecuredLoginStringClaim_sub="thePrincipalName";
 * };
 * </pre>
 *
 * An implementation of the {@link Login} interface specific to the
 * {@code OAUTHBEARER} mechanism is automatically applied; it periodically
 * refreshes any token before it expires so that the client can continue to make
 * connections to brokers. The parameters that impact how the refresh algorithm
 * operates are specified as part of the producer/consumer/broker configuration
 * are as follows. See the documentation for these properties elsewhere for
 * details.
 * <table>
 * <tr>
 * <th>Producer/Consumer/Broker Configuration Property</th>
 * </tr>
 * <tr>
 * <td>{@code sasl.login.refresh.window.factor}</td>
 * </tr>
 * <tr>
 * <td>{@code sasl.login.refresh.window.jitter}</td>
 * </tr>
 * <tr>
 * <td>{@code sasl.login.refresh.min.period.seconds}</td>
 * </tr>
 * <tr>
 * <td>{@code sasl.login.refresh.min.buffer.seconds}</td>
 * </tr>
 * </table>
 * When a broker accepts a SASL/OAUTHBEARER connection the instance of the
 * builtin {@code SaslServer} implementation asks its configured
 * {@link AuthenticateCallbackHandler} implementation to handle an instance of
 * {@link OAuthBearerValidatorCallback} constructed with the OAuth 2 Bearer
 * Token's compact serialization and return an instance of
 * {@link OAuthBearerToken} if the value validates. A default, builtin
 * {@link AuthenticateCallbackHandler} implementation validates an unsecured
 * token as defined by these JAAS module options:
 * <table>
 * <tr>
 * <th>JAAS Module Option for Unsecured Token Validation</th>
 * <th>Documentation</th>
 * </tr>
 * <tr>
 * <td>{@code unsecuredValidatorPrincipalClaimName="value"}</td>
 * <td>Set to a non-empty value if you wish a particular String claim holding a
 * principal name to be checked for existence; the default is to check for the
 * existence of the '{@code sub}' claim.</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredValidatorScopeClaimName="value"}</td>
 * <td>Set to a custom claim name if you wish the name of the String or String
 * List claim holding any token scope to be something other than
 * '{@code scope}'.</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredValidatorRequiredScope="value"}</td>
 * <td>Set to a space-delimited list of scope values if you wish the
 * String/String List claim holding the token scope to be checked to make sure
 * it contains certain values.</td>
 * </tr>
 * <tr>
 * <td>{@code unsecuredValidatorAllowableClockSkewMs="value"}</td>
 * <td>Set to a positive integer value if you wish to allow up to some number of
 * positive milliseconds of clock skew (the default is 0).</td>
 * </tr>
 * </table>
 * Here is a typical, basic JAAS configuration for a broker leveraging unsecured
 * SASL/OAUTHBEARER validation:
 *
 * <pre>
 * KafkaServer {
 *      org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule Required
 *      unsecuredLoginStringClaim_sub="thePrincipalName";
 * };
 * </pre>
 *
 * Production use cases will require writing an implementation of
 * {@link AuthenticateCallbackHandler} that can handle an instance of
 * {@link OAuthBearerValidatorCallback} and declaring it via the
 * {@code listener.name.sasl_ssl.oauthbearer.sasl.server.callback.handler.class}
 * configuration option.
 *
 * @see SaslConfigs#SASL_LOGIN_REFRESH_WINDOW_FACTOR_DOC
 * @see SaslConfigs#SASL_LOGIN_REFRESH_WINDOW_JITTER_DOC
 * @see SaslConfigs#SASL_LOGIN_REFRESH_MIN_PERIOD_SECONDS_DOC
 * @see SaslConfigs#SASL_LOGIN_REFRESH_MIN_BUFFER_SECONDS_DOC
 */
public class OAuthBearerLoginModule implements LoginModule {
    static {
        OAuthBearerSaslClientProvider.initialize(); // not part of public API
        OAuthBearerSaslServerProvider.initialize(); // not part of public API
    }

    // etc...
}

package org.apache.kafka.common.security.oauthbearer;

/**
 * A {@code Callback} for use by the {@code SaslClient} and {@code Login}
 * implementations when they require an OAuth 2 bearer token. Callback handlers
 * should use the {@link #error(String, String, String)} method to communicate
 * errors returned by the authorization server as per
 * <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
 * 2.0 Authorization Framework</a>. Callback handlers should communicate other
 * problems by raising an {@code IOException}.
 */
public class OAuthBearerTokenCallback implements Callback {
    private OAuthBearerToken token = null;
    private String errorCode = null;
    private String errorDescription = null;
    private String errorUri = null;

    /**
     * Return the (potentially null) token
     *
     * @return the (potentially null) token
     */
    public OAuthBearerToken token() {
        return token;
    }

package org.apache.kafka.common.security.oauthbearer;

/**
 * A {@code Callback} for use by the {@code SaslClient} and {@code Login}
 * implementations when they require an OAuth 2 bearer token. Callback handlers
 * should use the {@link #error(String, String, String)} method to communicate
 * errors returned by the authorization server as per
 * <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
 * 2.0 Authorization Framework</a>. Callback handlers should communicate other
 * problems by raising an {@code IOException}.
 */
public class OAuthBearerLoginCallback implements Callback {
    private OAuthBearerToken token = null;
    private String errorCode = null;
    private String errorDescription = null;
    private String errorUri = null;

    /**
     * Return the (potentiallyalways nullnon-empty) token
error code as   *per
     * @return the (potentially null) token<a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
     */
    public OAuthBearerToken token 2.0 Authorization Framework</a>.
     *
     * @return the (always non-empty) error code
     */
    public String errorCode() {
        return tokenerrorCode;
    }

    /**
     * Return the (alwayspotentially non-emptynull) error codedescription as per
     * <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
     * 2.0 Authorization Framework</a>.
     *
     * @return the (alwayspotentially non-emptynull) error codedescription
     */
    public String errorCodeerrorDescription() {
        return errorCodeerrorDescription;
    }

    /**
     * Return the (potentially null) error descriptionURI as per
     * <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
     * 2.0 Authorization Framework</a>.
     *
     * @return the (potentially null) error descriptionURI
     */
    public String errorDescriptionerrorUri() {
        return errorDescriptionerrorUri;
    }

    /**
     * ReturnSet the (potentially null)token. All error-related URIvalues asare percleared.
     *
 <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth    * @param token
     * 2.0 Authorization Framework</a>.
     *
     * @return the (potentiallymandatory null)token errorto URIset
     */
    public Stringvoid errorUritoken(OAuthBearerToken token) {
        this.token return errorUri= Objects.requireNonNull(token);
    }

    this.errorCode = /**null;
     * Set the tokenthis.errorDescription All error-related values are cleared.= null;
     *
   this.errorUri = null;
    }

  * @param token/**
     * Set the error values as per
     * the mandatory token to set<a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
     */
 2.0 Authorization Framework</a>. publicAny void token(OAuthBearerToken token)is {cleared.
     *
    this.token = Objects.requireNonNull(token); * @param errorCode
     *   this.errorCode = null;
        this.errorDescription = null;the mandatory error code to set
     * @param errorDescription
 this.errorUri = null;
  *  }

    /**
     * Setthe theoptional error valuesdescription asto perset
     * <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth@param errorCode
     * 2.0 Authorization Framework</a>. Any token is cleared.
     *
the optional error URI to * @param errorCodeset
     */
    public void error(String errorCode, String errorDescription, String errorUri) the{
 mandatory error code to set
     * @param errorDescriptionif (Objects.requireNonNull(errorCode).isEmpty())
     *       throw new IllegalArgumentException("error code must thenot optional error description to set
be empty");
        *this.errorCode @param= errorCode;
     *   this.errorDescription = errorDescription;
       the optionalthis.errorUri error URI to set= errorUri;
     */
   this.token public= void error(String errorCode, String errorDescription, String errorUri) {
        if (Objects.requireNonNull(errorCode).isEmpty())
            throw new IllegalArgumentException("error code must not be empty");
        this.errorCode = errorCode;
        this.errorDescription = errorDescription;
        this.errorUri = errorUri;
        this.token = null;
    }
}null;
    }
}

package org.apache.kafka.common.security.oauthbearer;

/**
 * A {@code Callback} for use by the {@code SaslServer} implementation when it
 * needs to provide an OAuth 2 bearer token compact serialization for
 * validation. Callback handlers should use the
 * {@link #error(String, String, String)} method to communicate errors back to
 * the SASL Client as per
 * <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
 * 2.0 Authorization Framework</a> and the <a href=
 * "https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error">IANA
 * OAuth Extensions Error Registry</a>. Callback handlers should communicate
 * other problems by raising an {@code IOException}.
 */
public class OAuthBearerValidatorCallback implements Callback {
    private final String tokenValue;
    private OAuthBearerToken token = null;
    private String errorStatus = null;
    private String errorScope = null;
    private String errorOpenIDConfiguration = null;

package org.apache.kafka.common.security.oauthbearer;

/**
 * A {@code Callback} for use by the {@code SaslServer} implementation when it
 * needs to provide an OAuth 2 bearer token compact serialization for
 * validation. Callback handlers should use the
 * {@link #error(String, String, String)} method to communicate errors back to
 * the SASL Client as per
 * <a href="https://tools.ietf.org/html/rfc6749#section-5.2">RFC 6749: The OAuth
 * 2.0 Authorization Framework</a> and the <a href=
 * "https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error">IANA
 * OAuth Extensions Error Registry</a>. Callback handlers should communicate
 * other problems by raising an {@code IOException}.
 */
public class OAuthBearerValidatorCallback implements Callback {
    private final String tokenValue;
    private OAuthBearerToken token = null;
    private String errorStatus = null;
    private String errorScope = null;
    private String errorOpenIDConfiguration = null;

    /**
     * Constructor
     *
     * @param tokenValue
     *            the mandatory/non-blank token value
     */
    public OAuthBearerValidatorCallback(String tokenValue) {
        if (Objects.requireNonNull(tokenValue).isEmpty())
            throw new IllegalArgumentException("token value must not be empty");
        this.tokenValue = tokenValue;
    }

    /**
     * Return the (always non-null) token value
     *
     * @return the (always non-null) token value
     */
    public String tokenValue() {
        return tokenValue;
    }

    /**
     * Return the (potentially null) tokenConstructor
     *
     * @return the (potentially null) token@param tokenValue
     */
    public OAuthBearerToken token() {
     the mandatory/non-blank token return token;value
    }

    /** */
     * Return the (potentially null) error status value as per
public OAuthBearerValidatorCallback(String tokenValue) {
       * <a href="https://tools.ietf.org/html/rfc7628#section-3.2.2">RFC 7628: A Set
if (Objects.requireNonNull(tokenValue).isEmpty())
         * of Simple Authenticationthrow and Security Layer (SASL) Mechanisms for OAuth</a>new IllegalArgumentException("token value must not be empty");
     * and the <athis.tokenValue href= tokenValue;
    }

  *  "https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error">IANA/**
     * OAuth Extensions Error Registry</a>. Return the (always non-null) token value
     *
     * @return the (potentiallyalways non-null) error statustoken value
     */
    public String errorStatustokenValue() {
        return errorStatustokenValue;
    }

    /**
     * Return the (potentially null) error scope value as per
     * <a href="https://tools.ietf.org/html/rfc7628#section-3.2.2">RFC 7628: A Set
     * of Simple Authentication and* SecurityReturn Layerthe (SASLpotentially null) Mechanisms for OAuth</a>.token
     *
     * @return the (potentially null) error scope valuetoken
     */
    public StringOAuthBearerToken errorScopetoken() {
        return errorScopetoken;
    }

    /**
     * Return the (potentially null) error openid-configurationstatus value as per
     * <a href="https://tools.ietf.org/html/rfc7628#section-3.2.2">RFC 7628: A Set
     * of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth</a>
     * and the <a href=
     * "https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error">IANA
     * OAuth Extensions Error Registry</a>.
     *
     * @return the (potentially null) error openid-configurationstatus value
     */
    public String errorOpenIDConfigurationerrorStatus() {
        return errorOpenIDConfigurationerrorStatus;
    }

    /**
     * SetReturn the token. The token value is unchanged and is expected to match the (potentially null) error scope value as per
     * <a href="https://tools.ietf.org/html/rfc7628#section-3.2.2">RFC 7628: A Set
     * of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth</a>.
     *
     * provided@return token's value. Allthe (potentially null) error values are cleared.scope value
     */
    public *String @paramerrorScope() token{
     *   return errorScope;
    }

    the mandatory token to set
     *//**
     * Return the (potentially null) error openid-configuration value as per
    public void* token(OAuthBearerToken token) {
  <a href="https://tools.ietf.org/html/rfc7628#section-3.2.2">RFC 7628: A Set
     * this.token = Objects.requireNonNull(token);
        this.errorStatus = null;
   of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth</a>.
     *
     this.errorScope* =@return null;
the (potentially null) error openid-configuration value
   this.errorOpenIDConfiguration = null;*/
    public }

    /**
String errorOpenIDConfiguration() {
       * Setreturn theerrorOpenIDConfiguration;
 error values as per}

     /**
 <a href="https://tools.ietf.org/html/rfc7628#section-3.2.2">RFC 7628: A Set
     * of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth</a>.   * Set the token. The token value is unchanged and is expected to match the
     * Anyprovided token is's value. All error values are cleared.
     *
     * @param errorStatustoken
     *            the mandatory errortoken status value from the <a href=to set
     *            "https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error">IANA
    public *void  token(OAuthBearerToken token) {
        OAuththis.token Extensions Error Registry</a> to set
= Objects.requireNonNull(token);
        *this.errorStatus @param= errorScopenull;
     *   this.errorScope = null;
       the optional error scope value to set this.errorOpenIDConfiguration = null;
    }

     * @param errorStatus/**
     * Set the error values as per
     * the optional error openid-configuration value to set<a href="https://tools.ietf.org/html/rfc7628#section-3.2.2">RFC 7628: A Set
     */
 of Simple Authentication and publicSecurity voidLayer error(StringSASL) errorStatus,Mechanisms String errorScope, String errorOpenIDConfiguration) {for OAuth</a>.
     * Any token ifis (Objects.requireNonNull(errorStatus).isEmpty())cleared.
     *
     * @param throwerrorStatus
 new IllegalArgumentException("error status must not* be empty");
        this.errorStatus = errorStatus;
the mandatory error status value from the <a this.errorScope = errorScope;href=
        this.errorOpenIDConfiguration = errorOpenIDConfiguration;
  *      this.token = null;
    }
}