[jira] [Created] (KAFKA-21198) Consider improving client-side visibility/logging for rejected Oauth token

["Lianet Magrans (Jira)" <ji...@apache.org>]

Lianet Magrans created KAFKA-21198:
--------------------------------------

             Summary: Consider improving client-side visibility/logging for rejected Oauth token
                 Key: KAFKA-21198
                 URL: https://issues.apache.org/jira/browse/KAFKA-21198
             Project: Kafka
          Issue Type: Task
          Components: clients
            Reporter: Lianet Magrans
            Assignee: Evan Zhou


The current los when an issue with the token leads to fail auth does not include anything to help identify the token, which makes it hard to correlate to the broker-side when a token is rejected.

Current client-side logging on token-related failure seems to be around principal only (debug level) here [https://github.com/apache/kafka/blob/7aba83304c69e151597ecfb4e8a004079cdd1ec8/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/OAuthBearerRefreshingLogin.java#L106] 

and nothing is logged where I expect the token failure on the related incident would land on the client side [https://github.com/apache/kafka/blob/7aba83304c69e151597ecfb4e8a004079cdd1ec8/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/OAuthBearerSaslClient.java#L100] 

This task is to review if logging could be improved (considering from the security pov, what would be helpful and acceptable to log)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)