[GitHub] [kafka] rajinisivaram commented on a change in pull request #10007: KAFKA-10700 - Support mutual TLS authentication for SASL_SSL listeners (KIP-684)

[GitBox <gi...@apache.org>]

rajinisivaram commented on a change in pull request #10007:
URL: https://github.com/apache/kafka/pull/10007#discussion_r568485297



##########
File path: clients/src/main/java/org/apache/kafka/common/network/ChannelBuilders.java
##########
@@ -129,6 +136,22 @@ private static ChannelBuilder create(SecurityProtocol securityProtocol,
                     jaasContexts = new HashMap<>(enabledMechanisms.size());
                     for (String mechanism : enabledMechanisms)
                         jaasContexts.put(mechanism, JaasContext.loadServerContext(listenerName, mechanism, configs));
+
+                    // SSL client authentication is enabled in brokers for SASL_SSL only if listener-prefixed config is specified.
+                    if (listenerName != null && securityProtocol == SecurityProtocol.SASL_SSL) {
+                        String configuredClientAuth = (String) configs.get(BrokerSecurityConfigs.SSL_CLIENT_AUTH_CONFIG);
+                        String listenerClientAuth = (String) config.originalsWithPrefix(listenerName.configPrefix(), true)
+                                .get(BrokerSecurityConfigs.SSL_CLIENT_AUTH_CONFIG);

Review comment:
       We can't do `config.getString(prefix+configName)` because `AbstractConfig` only allows configs from its definition to be obtained using `get` and the prefixed config is not treated as a defined config. I couldn't think of alternative way that doesn't need the originals in some form. As you said, it is only used once when broker starts up, so should be ok. But happy to change if you can think of an alternative.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org