You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@fluss.apache.org by "litiliu (via GitHub)" <gi...@apache.org> on 2026/08/05 08:18:46 UTC
[PR] [security] Make SASL mechanisms extensible [fluss]
litiliu opened a new pull request, #3865:
URL: https://github.com/apache/fluss/pull/3865
<!-- Generated-by: OpenAI Codex following [the guidelines](https://github.com/apache/fluss/blob/main/AGENTS.md) -->
### Purpose
Related issue: #3495
This PR prepares the Fluss RPC SASL authentication layer for adding built-in mechanisms such as OAUTHBEARER. The existing implementation constructs PLAIN authenticators directly, which makes adding another mechanism require changing the PLAIN implementation path.
This is intentionally a foundation-only change. It does not add OAuth token acquisition, JWT validation, JWKS handling, group principals, or ACL changes.
### Brief change log
- Add a stateless `SaslAuthenticatorFactory` that selects a built-in SASL mechanism and creates one connection-local authenticator.
- Extract the existing PLAIN server implementation into `PlainSaslServerAuthenticator`.
- Keep `SaslServerAuthenticator` as the connection-local dispatcher that validates the requested server mechanism and delegates authentication.
- Preserve the existing PLAIN configuration, JAAS fallback, RPC handshake, and authentication behavior.
- Reject an unsupported client mechanism when the client authenticator is created instead of during connection initialization.
- Add focused coverage for mechanism selection, case normalization, independent authenticator instances, and unsupported mechanisms.
### Tests
- `./mvnw -pl fluss-common -DskipITs -Dtest=SaslAuthenticatorFactoryTest,PlainSaslServerTest clean test`
- 7 tests passed.
- Checkstyle and Spotless passed.
- `git diff --check`
### API and Format
No public API, RPC wire format, or storage format changes.
The new factory is internal. No new configuration options are introduced.
### Documentation
No documentation changes are required because this PR does not expose a new authentication mechanism or configuration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [security] Make SASL mechanisms extensible [fluss]
Posted by "litiliu (via GitHub)" <gi...@apache.org>.
litiliu commented on PR #3865:
URL: https://github.com/apache/fluss/pull/3865#issuecomment-5251601009
@affo PTAL, Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [security] Make SASL mechanisms extensible [fluss]
Posted by "litiliu (via GitHub)" <gi...@apache.org>.
litiliu commented on PR #3865:
URL: https://github.com/apache/fluss/pull/3865#issuecomment-5200369864
@loserwang1024 hongshun, PTAL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [security] Make SASL mechanisms extensible [fluss]
Posted by "litiliu (via GitHub)" <gi...@apache.org>.
litiliu commented on PR #3865:
URL: https://github.com/apache/fluss/pull/3865#issuecomment-5261365288
@polyzos PTAL, Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [security] Make SASL mechanisms extensible [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo commented on code in PR #3865:
URL: https://github.com/apache/fluss/pull/3865#discussion_r3765617699
##########
fluss-common/src/main/java/org/apache/fluss/security/auth/sasl/SaslAuthenticatorFactory.java:
##########
@@ -0,0 +1,80 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.fluss.security.auth.sasl;
+
+import org.apache.fluss.annotation.Internal;
+import org.apache.fluss.config.ConfigOptions;
+import org.apache.fluss.config.Configuration;
+import org.apache.fluss.exception.AuthenticationException;
+import org.apache.fluss.security.auth.ClientAuthenticator;
+import org.apache.fluss.security.auth.ServerAuthenticator;
+import org.apache.fluss.security.auth.sasl.authenticator.PlainSaslServerAuthenticator;
+import org.apache.fluss.security.auth.sasl.authenticator.SaslClientAuthenticator;
+import org.apache.fluss.security.auth.sasl.plain.PlainSaslServer;
+
+import java.util.Locale;
+
+/** Factory for creating connection-local SASL authenticators. */
+@Internal
+public final class SaslAuthenticatorFactory {
+ private SaslAuthenticatorFactory() {}
Review Comment:
I see here that adding a new mechanism would imply editing 3 `switch` statements.
Can we make it better and store a map `mechanism -> (clientAuth, serverAuth)`?
The result would be that one would imply add an entry in the map and the implementation of the methods below would simply test the maps and would not need changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [security] Make SASL mechanisms extensible [fluss]
Posted by "litiliu (via GitHub)" <gi...@apache.org>.
litiliu commented on PR #3865:
URL: https://github.com/apache/fluss/pull/3865#issuecomment-5313993278
@fresh-borzoni Would you mind taking a look at this PR, when you have time, Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org