You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by "Nandini Singhal (Jira)" <ji...@apache.org> on 2026/07/24 12:18:00 UTC

[jira] [Created] (KAFKA-20831) Cache SASL KafkaPrincipal for the lifetime of an authenticated connection

Nandini Singhal created KAFKA-20831:
---------------------------------------

             Summary: Cache SASL KafkaPrincipal for the lifetime of an authenticated connection
                 Key: KAFKA-20831
                 URL: https://issues.apache.org/jira/browse/KAFKA-20831
             Project: Kafka
          Issue Type: Bug
            Reporter: Nandini Singhal


SaslServerAuthenticator.principal() currently creates a new SaslAuthenticationContext and invokes the configured KafkaPrincipalBuilder every time the principal is requested.

KafkaChannel.principal() is consulted while request contexts are constructed, so the principal builder can be invoked repeatedly for every request on the same authenticated connection. The authenticated identity is connection-scoped and custom principal builders may perform non-trivial work or have side effects.

The principal should be built once after successful authentication and reused for the lifetime of that authenticated session.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)