[jira] [Created] (THRIFT-6206) Go: Add SASL / Kerberos Authentication Transport support (TSaslTransport)

["Sylwester Lachiewicz (Jira)" <ji...@apache.org>]

Sylwester Lachiewicz created THRIFT-6206:
--------------------------------------------

             Summary: Go: Add SASL / Kerberos Authentication Transport support (TSaslTransport)
                 Key: THRIFT-6206
                 URL: https://issues.apache.org/jira/browse/THRIFT-6206
             Project: Thrift
          Issue Type: New Feature
          Components: Go - Library
            Reporter: Sylwester Lachiewicz


Currently, Apache Thrift provides SASL transport support across major language libraries including Java (TSaslClientTransport / TSaslServerTransport), C++, and Python, which are standard for authenticating Thrift services against Kerberos/GSSAPI (e.g., Apache Hive, Impala, HBase). However, the Go library (lib/go/thrift) currently lacks SASL transport support, requiring Go consumers to either maintain custom forks or implement ad-hoc transport wrappers.

### Proposed Solution
Implement TSaslClientTransport in lib/go/thrift adhering to Thrift's standard SASL negotiation framing:
1. Framing & Protocol:
   - Status byte headers: START (1), OK (2), BAD (3), ERROR (4), COMPLETE (5), followed by 4-byte big-endian payload length.
   - Message payload negotiation loop handling challenge-response handshakes.
2. Pluggable Mechanism Interface:
   - Define a zero-dependency interface (SaslClientMechanism) in lib/go/thrift for negotiation (Start, Step, IsComplete, Dispose).
3. Pure-Go Built-in Mechanisms & Extensibility:
   - Provide a built-in PLAIN mechanism with zero third-party dependencies.
   - Allow external providers (such as GSSAPI / Kerberos via pure-Go libraries like gokrb5) to be plugged in via the interface without adding heavy external dependencies to Thrift's core go.mod.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)