[jira] [Created] (KAFKA-14681) Refreshing Kerberos TGT is not using CallbackHandler (causing failure to refresh)

["Vlad D. (Jira)" <ji...@apache.org>]

Vlad D. created KAFKA-14681:
-------------------------------

             Summary: Refreshing Kerberos TGT is not using CallbackHandler (causing failure to refresh)
                 Key: KAFKA-14681
                 URL: https://issues.apache.org/jira/browse/KAFKA-14681
             Project: Kafka
          Issue Type: Bug
          Components: security
            Reporter: Vlad D.


The SASL + Kerberos authentication in KerberosLogin.java class, when obtaining Kerberos TGT, makes use of the client-provided callback handler. This is a must-have when the security configuration is not default.

However, the same code, when it is time to renew the Kerberos TGT ticket, ignores the provided ticket. That works OK for default configuration (JAAS configuration, Kerberos config and keytab are available).

But when the security configuration sources are custom, and the default Kerberos code is not supporting them, the callback is to be used to obtain the configuration properties.

A fix is done to pass the same callback handler in KerberosLogin::reLogin and store the callback handler in the super class AbstractLogin, similar to contextName and configuration.

The fix is in PR [https://github.com/apache/kafka/pull/13081]

It is tested in our SFT environments and works fine.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)