(kafka) branch 4.4 updated: KAFKA-19583 Enable OAUTHBEARER SASL in the native image (#23397)

[ch...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

chia7712 pushed a commit to branch 4.4
in repository https://gitbox.apache.org/repos/asf/kafka.git


The following commit(s) were added to refs/heads/4.4 by this push:
     new cde04b201d0 KAFKA-19583 Enable OAUTHBEARER SASL in the native image (#23397)
cde04b201d0 is described below

commit cde04b201d0beb7804f3137566f0b4792593d92c
Author: Murali Basani <mu...@aiven.io>
AuthorDate: Fri Sep 11 04:17:18 2026 +0200

    KAFKA-19583 Enable OAUTHBEARER SASL in the native image (#23397)
    
    The native Kafka image failed to start with
    KAFKA_SASL_ENABLED_MECHANISMS=OAUTHBEARER, throwing "Could not find a
    public no-argument constructor" for
    OAuthBearerUnsecuredLoginCallbackHandler. GraalVM native-image prunes
    the no-arg constructors of classes that Kafka instantiates reflectively
    (via Utils.newInstance, JAAS LoginContext and the SASL JCA providers)
    unless they are listed in the reachability metadata.
    
    Register the OAUTHBEARER classes in
    docker/native/native-image-configs/reflect-config.json, mirroring how
    PLAIN, SCRAM and Kerberos are already registered:
    
    - OAuthBearerLoginModule, OAuthBearerRefreshingLogin
    - OAuthBearerLoginCallbackHandler, OAuthBearerValidatorCallbackHandler,
      OAuthBearerSaslClientCallbackHandler,
      OAuthBearerUnsecuredLoginCallbackHandler
    - JwtRetriever implementations (ClientCredentials, Default, File,
      JwtBearer) and JwtValidator implementations (Broker, Client, Default)
    - OAuthBearerSaslClientFactory, OAuthBearerSaslServerFactory
    
    This covers both the unsecured and the secured (OIDC) OAUTHBEARER flows.
    
    Verified manually with the native image: unsecured OAUTHBEARER
    produce/consume, and the OIDC client-credentials flow against Entra ID
    using OAuthBearerLoginCallbackHandler /
    OAuthBearerValidatorCallbackHandler.
    
    Reviewers: Chia-Ping Tsai <ch...@gmail.com>
---
 .../native-image-configs/reflect-config.json       | 58 +++++++++++++++++++++-
 1 file changed, 56 insertions(+), 2 deletions(-)

diff --git a/docker/native/native-image-configs/reflect-config.json b/docker/native/native-image-configs/reflect-config.json
index b36559f848b..86798f587b3 100644
--- a/docker/native/native-image-configs/reflect-config.json
+++ b/docker/native/native-image-configs/reflect-config.json
@@ -1035,10 +1035,64 @@
   "methods":[{"name":"<init>","parameterTypes":[] }]
 },
 {
-  "name":"org.apache.kafka.common.security.oauthbearer.DefaultJwtRetriever"
+  "name":"org.apache.kafka.common.security.oauthbearer.ClientCredentialsJwtRetriever",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.DefaultJwtRetriever",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
 },
 {
-  "name":"org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator"
+  "name":"org.apache.kafka.common.security.oauthbearer.FileJwtRetriever",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.JwtBearerJwtRetriever",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.ClientJwtValidator",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginCallbackHandler",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerRefreshingLogin",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerSaslClient$OAuthBearerSaslClientFactory",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerSaslClientCallbackHandler",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerSaslServer$OAuthBearerSaslServerFactory",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
+},
+{
+  "name":"org.apache.kafka.common.security.oauthbearer.internals.unsecured.OAuthBearerUnsecuredLoginCallbackHandler",
+  "methods":[{"name":"<init>","parameterTypes":[] }]
 },
 {
   "name":"org.apache.kafka.common.security.plain.PlainLoginModule",