Table of Contents |
---|
Status
Current state: Draft Discuss
Discussion thread: here [Change the link from the KIP proposal email archive to your own email thread]
JIRA: KAFKA-4180
Motivation
Currently the Kafka java client does not support different login contexts from within the same JVM.
IBM MessageHub has encountered many users asking for this functionality, e.g. having multiple consumers and producers in a single JVM that consumer/produce to different Kafka clusters, each requiring specific credentials.
Public Interfaces
A new LoginModule
class will be added to be referenced by fully qualified name in jaas.conf
, e.g.
org.apache.kafka.common.security.plain.MultiUserPlainLoginModule
and a new public interface such as
public interface CredentialProvider {
public String getUserName(String clientId);
public char[] getPassword(String clientId);
}
A CredentialProvider uses , which reads the client.id
property from the consumer.properties/producer.properties file, and will look for provides username and password corresponding to that clientid by querying a supplied implementation of a (new) CredentialProvider interface
Proposed Changes
...
.
The user should provide an implementation of CredentialProvider but a sample implementation that reads values from jaas.conf
will be supplied.
Example of jaas.conf :
KafkaClient {
org.apache.kafka.common.security.plain.MultiUserPlainLoginModule
serviceName="kafka"
credentialProvider="org.apache.kafka.common.security.plain.DefaultCredentialProvider";
};
Proposed Changes
MultiUserPlainLoginModule
on inititialize(Subject..)
adds a specific Principal to the subject which has a handle to an instance of CredentialProvider
SaslClientCallbackHandler saves the consumer/producer configs passed to configure(...)
SaslClientCallbackHandler on handle(Callback[])
will check if the subject contains the multi-user principal,
and if so will delegate the retrieval of username and password to the CredentialProvider, else will keep the current behavior
Compatibility, Deprecation, and Migration Plan
- The old SimpleLoginModule
PlainLoginModule
and its expectedjaas.conf
may format can remain unchanged for backward compatibility for users that don't require the new functionality
This KIP is based on previous work by Rajini Sivaram. Thanks Rajini!