You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "Lianet Magrans (Jira)" <ji...@apache.org> on 2026/10/16 14:59:00 UTC
[jira] [Updated] (KAFKA-21296) OAuth login calls do not apply default timeouts as defined in KIP-768
[ https://issues.apache.org/jira/browse/KAFKA-21296?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lianet Magrans updated KAFKA-21296:
-----------------------------------
Description:
The client configs sasl.login.connect.timeout.ms and sasl.login.read.timeout.ms are optional, defined without defaults in the code, and set only when defined by the app, here [https://github.com/apache/kafka/blob/8e65883c1255f93361bbf29efa8425e30b40c5ec/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/HttpJwtRetriever.java#L212-L216]
KIP-768 does define default values for them (10000 ms), but the implementation does not seem to consider them, so if not set by the app, calls to the token endpoint would run without explicit boundaries I expect (so hang if the token endpoint does not respond promptly).
Login calls are triggred from the clients constructors, so I expect the hang could happen when creating them (this login [https://github.com/apache/kafka/blob/8e65883c1255f93361bbf29efa8425e30b40c5ec/clients/src/main/java/org/apache/kafka/common/security/authenticator/LoginManager.java#L69])
This Jira is to review this path and fix by applying the defaults proposed by KIP-798.
was:
The client configs sasl.login.connect.timeout.ms and sasl.login.read.timeout.ms are optional, defined without defaults in the code, and set only when defined by the app, here [https://github.com/apache/kafka/blob/8e65883c1255f93361bbf29efa8425e30b40c5ec/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/HttpJwtRetriever.java#L212-L216]
KIP-768 does define default values for them (10000 ms), but the implementation does not seem to consider them, so if not set by the app, calls to connect/read to the token endpoint would run without explicit boundaries I expect (so hang if the token endpoint does not respond promptly).
Login calls are triggred from the clients constructors, so I expect the hang could happen when creating them (this login https://github.com/apache/kafka/blob/8e65883c1255f93361bbf29efa8425e30b40c5ec/clients/src/main/java/org/apache/kafka/common/security/authenticator/LoginManager.java#L69)
This Jira is to review this path and fix by applying the defaults proposed by KIP-798.
> OAuth login calls do not apply default timeouts as defined in KIP-768
> ---------------------------------------------------------------------
>
> Key: KAFKA-21296
> URL: https://issues.apache.org/jira/browse/KAFKA-21296
> Project: Kafka
> Issue Type: Bug
> Components: clients
> Reporter: Lianet Magrans
> Priority: Major
>
> The client configs sasl.login.connect.timeout.ms and sasl.login.read.timeout.ms are optional, defined without defaults in the code, and set only when defined by the app, here [https://github.com/apache/kafka/blob/8e65883c1255f93361bbf29efa8425e30b40c5ec/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/HttpJwtRetriever.java#L212-L216]
> KIP-768 does define default values for them (10000 ms), but the implementation does not seem to consider them, so if not set by the app, calls to the token endpoint would run without explicit boundaries I expect (so hang if the token endpoint does not respond promptly).
> Login calls are triggred from the clients constructors, so I expect the hang could happen when creating them (this login [https://github.com/apache/kafka/blob/8e65883c1255f93361bbf29efa8425e30b40c5ec/clients/src/main/java/org/apache/kafka/common/security/authenticator/LoginManager.java#L69])
> This Jira is to review this path and fix by applying the defaults proposed by KIP-798.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)