You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by GitBox <gi...@apache.org> on 2020/11/17 16:00:03 UTC
[GitHub] [kafka] rajinisivaram opened a new pull request #9605: KAFKA-10727; Handle Kerberos error during re-login as transient failure in clients
rajinisivaram opened a new pull request #9605:
URL: https://github.com/apache/kafka/pull/9605
We use a background thread for Kerberos to perform re-login before tickets expire. The thread performs logout() followed by login(), relying on the Java library to clear and then populate credentials in Subject. This leaves a timing window where clients fail to authenticate because credentials are not available. We cannot introduce any form of locking since authentication is performed on the network thread. So this PR treats NO_CRED as a transient failure rather than a fatal authentication exception in clients.
### Committer Checklist (excluded from commit message)
- [ ] Verify design and implementation
- [ ] Verify test coverage and CI build status
- [ ] Verify documentation (including upgrade notes)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] rajinisivaram merged pull request #9605: KAFKA-10727; Handle Kerberos error during re-login as transient failure in clients
Posted by GitBox <gi...@apache.org>.
rajinisivaram merged pull request #9605:
URL: https://github.com/apache/kafka/pull/9605
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] rajinisivaram commented on pull request #9605: KAFKA-10727; Handle Kerberos error during re-login as transient failure in clients
Posted by GitBox <gi...@apache.org>.
rajinisivaram commented on pull request #9605:
URL: https://github.com/apache/kafka/pull/9605#issuecomment-732024151
@omkreddy @rondagostino Thanks for the reviews.
@rondagostino Yes, I had checked the OAuth code path to see if it had the same issue and found that you had already taken care of that :-)
Quota test failure not related, merging to trunk.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org