You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@kafka.apache.org by "RivenSun (Jira)" <ji...@apache.org> on 2022/03/17 03:37:00 UTC
[jira] [Created] (KAFKA-13751) On the broker side, OAUTHBEARER is not compatible with other SASL mechanisms
RivenSun created KAFKA-13751:
--------------------------------
Summary: On the broker side, OAUTHBEARER is not compatible with other SASL mechanisms
Key: KAFKA-13751
URL: https://issues.apache.org/jira/browse/KAFKA-13751
Project: Kafka
Issue Type: Bug
Components: security
Affects Versions: 3.0.1
Reporter: RivenSun
h1. Phenomenon:
SASL/OAUTHBEARER, whether implemented by default or customized by the user, is not compatible with other SASL mechanisms.
h3.
case1:
kafka_server_jaas_oauth.conf
{code:java}
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin"
user_admin="admin"
user_alice="alice";
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
org.apache.kafka.common.security.scram.ScramLoginModule required
username="admin"
password="admin_scram";
}; {code}
server.properties
{code:java}
advertised.listeners=SASL_PLAINTEXT://publicIp:8779,SASL_SSL://publicIp:8889,OAUTH://publicIp:8669
listener.security.protocol.map=INTERNAL_SSL:SASL_SSL,PLAINTEXT:PLAINTEXT,SSL:SSL,SASL_PLAINTEXT:SASL_PLAINTEXT,SASL_SSL:SASL_SSL,OAUTH:SASL_SSL
sasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256,SCRAM-SHA-512,OAUTHBEARER{code}
Error when starting kafka:
server.log
{code:java}
[2022-03-16 13:18:42,658] ERROR [KafkaServer id=1] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
org.apache.kafka.common.KafkaException: java.lang.IllegalArgumentException: Must supply exactly 1 non-null JAAS mechanism configuration (size was 3)
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:172)
at kafka.network.Processor.<init>(SocketServer.scala:724)
at kafka.network.SocketServer.newProcessor(SocketServer.scala:367)
at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:252)
at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:251)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:214)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:211)
at scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
at scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:211)
at kafka.network.SocketServer.startup(SocketServer.scala:122)
at kafka.server.KafkaServer.startup(KafkaServer.scala:266)
at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:82)
at kafka.Kafka.main(Kafka.scala)
Caused by: java.lang.IllegalArgumentException: Must supply exactly 1 non-null JAAS mechanism configuration (size was 3)
at org.apache.kafka.common.security.oauthbearer.internals.unsecured.OAuthBearerUnsecuredValidatorCallbackHandler.configure(OAuthBearerUnsecuredValidatorCallbackHandler.java:117)
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:139)
... 17 more
[2022-03-16 13:18:42,662] INFO [KafkaServer id=1] shutting down (kafka.server.KafkaServer)
[2022-03-16 13:18:42,664] INFO [SocketServer brokerId=1] Stopping socket server request processors (kafka.network.SocketServer) {code}
The default implementation class of oauthbearer's `sasl.server.callback.handler.class` is OAuthBearerUnsecuredValidatorCallbackHandler.
In the OAuthBearerUnsecuredValidatorCallbackHandler#configure(...) method, the jaasConfigEntries parameter is verified.
What I want to say is that {*}the verification logic here is completely reasonable{*}, but the jaasConfigEntries passed in from the upper layer should not contain the AppConfigurationEntry of other loginModules. There are several other codes for the check of the same keyword *"Must supply exactly 1 non-null JAAS mechanism configuration".*
Rootcause elaborates later.
By the way, at present, KafkaServer allows {*}the same LoginModule to be configured multiple times in kafkaJaasConfigFile{*}, which will also lead to the phenomenon of case1.
kafka_server_jaas_oauth.conf eg：
{code:java}
KafkaServer {
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
}; {code}
h3. case2:
On the basis of case1, modify the default implementation of oauthbearer's `sasl.server.callback.handler.class`
server.properties add new configuration
{code:java}
listener.name.sasl_plaintext.oauthbearer.sasl.server.callback.handler.class=us.zoom.mq.security.oauth.AsyncMQOAuthCallbackHandler
listener.name.sasl_ssl.oauthbearer.sasl.server.callback.handler.class=us.zoom.mq.security.oauth.AsyncMQOAuthCallbackHandler
listener.name.oauth.oauthbearer.sasl.server.callback.handler.class=us.zoom.mq.security.oauth.AsyncMQOAuthCallbackHandler {code}
The specific implementation class code is omitted here.
When we start kafka again, we still encounter exceptions
server.log
{code:java}
[2022-03-16 14:47:46,037] ERROR Unrecognized SASL Login callback (org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule)
javax.security.auth.callback.UnsupportedCallbackException: Unrecognized SASL Login callback
at org.apache.kafka.common.security.authenticator.AbstractLogin$DefaultLoginCallbackHandler.handle(AbstractLogin.java:105)
at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.identifyToken(OAuthBearerLoginModule.java:316)
at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.login(OAuthBearerLoginModule.java:301)
at java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:726)
at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:665)
at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:663)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
at java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:663)
at java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:574)
at org.apache.kafka.common.security.authenticator.AbstractLogin.login(AbstractLogin.java:60)
at org.apache.kafka.common.security.authenticator.LoginManager.<init>(LoginManager.java:62)
at org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:112)
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:158)
at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:157)
at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:97)
at kafka.network.Processor.<init>(SocketServer.scala:724)
at kafka.network.SocketServer.newProcessor(SocketServer.scala:367)
at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:252)
at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:251)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:214)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:211)
at scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
at scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:211)
at kafka.network.SocketServer.startup(SocketServer.scala:122)
at kafka.server.KafkaServer.startup(KafkaServer.scala:266)
at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:82)
at kafka.Kafka.main(Kafka.scala)
[2022-03-16 14:47:46,048] ERROR [KafkaServer id=1] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
org.apache.kafka.common.KafkaException: javax.security.auth.login.LoginException: An internal error occurred while retrieving token from callback handler
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:172)
at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:157)
at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:97)
at kafka.network.Processor.<init>(SocketServer.scala:724)
at kafka.network.SocketServer.newProcessor(SocketServer.scala:367)
at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:252)
at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:251)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:214)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:211)
at scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
at scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:211)
at kafka.network.SocketServer.startup(SocketServer.scala:122)
at kafka.server.KafkaServer.startup(KafkaServer.scala:266)
at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:82)
at kafka.Kafka.main(Kafka.scala)
Caused by: javax.security.auth.login.LoginException: An internal error occurred while retrieving token from callback handler
at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.identifyToken(OAuthBearerLoginModule.java:319)
at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.login(OAuthBearerLoginModule.java:301)
at java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:726)
at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:665)
at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:663)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
at java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:663)
at java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:574)
at org.apache.kafka.common.security.authenticator.AbstractLogin.login(AbstractLogin.java:60)
at org.apache.kafka.common.security.authenticator.LoginManager.<init>(LoginManager.java:62)
at org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:112)
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:158)
... 17 more
[2022-03-16 14:47:46,049] INFO [KafkaServer id=1] shutting down (kafka.server.KafkaServer)
[2022-03-16 14:47:46,052] INFO [SocketServer brokerId=1] Stopping socket server request processors (kafka.network.SocketServer) {code}
By analyzing the stack, it is easy to see the problem:
1) AbstractLogin.login should not call the OAuthBearerLoginModule.login method, only OAuthBearerRefreshingLogin.login can call the OAuthBearerLoginModule.login method.
2) OAuthBearerLoginModule.login should not call the AbstractLogin$DefaultLoginCallbackHandler.handle method, it should call the OAuthBearerUnsecuredLoginCallbackHandler.handle method.
Analyze the stack, read the source code, the root cause is:
In the ChannelBuilders#create method, if the corresponding JaasContext of each SASL mechanism is returned by the *JaasContext#defaultContext()* method, the *JaasContext.configuration* and *JaasContext.configurationEntries* fields both contain the AppConfigurationEntry of other mechanisms. And then in the subsequent code stack, resulting in case1 or case2.
In fact, you can find from some source codes of Kafka saslModule that Kafka has this {*}original intention: JaasContext per saslMechanism should be pure{*}.
1) In the ChannelBuilders#create(...) method, when constructing the SaslChannelBuilder, `Map<String, JaasContext> jaasContexts` is passed in
2) In the SaslChannelBuilder#configure(...) method, after constructing LoginManager, LoginManager is also stored with `Map<String, LoginManager> loginManagers`.
The keys of these two maps are {*}saslMechanism{*}, but their values both contain all saslMechanism information. Affected by this behavior, jaasConfigEntries in OAuthBearerUnsecuredValidatorCallbackHandler also contains other saslMechanism information, other implementation classes of sasl.server.callback.handler.class have the same problem.
In fact, I have reported an issue a long time ago, and KAFKA-13422 has the same RC and Solution as this issue.
https://issues.apache.org/jira/browse/KAFKA-13422
For more detailed RC analysis and solutions you can read the last two parts of the description of KAFKA-13422: Root Cause and Suggestion & Solutions.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)