You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@kafka.apache.org by Chia-Ping Tsai <ch...@apache.org> on 2025/03/06 08:31:57 UTC
Re: KIP-1135: Deprecated "org.apache.kafka.disallowed.login.modules"
hi Xuan-Zhang
Thanks for this kip. Please take a look at following questions.
cp00:
the description "(optional) we can deprecate `org.apache.kafka.disallowed.login.m ..." seems be a little weird to me, since we normally introduce a new config and deprecate the old one at the same time.
cp01:
could you please add the default allowed lists to the KIP?
cp02:
blacklist -> disallowed list
thanks,
chia-ping
On 2025/02/20 05:55:39 龚宣璋 wrote:
> Hey all,
>
> I would like to discuss a proposal regarding the JAAS-related processes.
> After some consideration, I believe we should adopt the approach of using
> an “allow-list” to filter modules, rather than relying on a “disallow-list.”
>
> Although this KIP is simple, I believe it offers significant value in terms
> of both security and efficiency. By focusing on what is allowed rather than
> what is denied, we can better control and ensure trusted modules are the
> only ones in use.
>
> Thanks!
>
> KIP:
> https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=340037077
> JIRA:
> https://issues.apache.org/jira/browse/KAFKA-18627
>
> --
> Best,
> Xuan-Zhang Gong
>
Re: KIP-1135: Deprecated "org.apache.kafka.disallowed.login.modules"
Posted by 龚宣璋 <go...@gmail.com>.
Thanks for your review.
Would it be better to change the title to “Modify JAAS” logic?
Chia-Ping Tsai <ch...@apache.org> 于2025年3月6日周四 16:32写道：
> hi Xuan-Zhang
>
> Thanks for this kip. Please take a look at following questions.
>
> cp00:
> the description "(optional) we can deprecate
> `org.apache.kafka.disallowed.login.m ..." seems be a little weird to me,
> since we normally introduce a new config and deprecate the old one at the
> same time.
>
> cp01:
> could you please add the default allowed lists to the KIP?
>
> cp02:
> blacklist -> disallowed list
>
> thanks,
> chia-ping
>
>
> On 2025/02/20 05:55:39 龚宣璋 wrote:
> > Hey all,
> >
> > I would like to discuss a proposal regarding the JAAS-related processes.
> > After some consideration, I believe we should adopt the approach of using
> > an “allow-list” to filter modules, rather than relying on a
> “disallow-list.”
> >
> > Although this KIP is simple, I believe it offers significant value in
> terms
> > of both security and efficiency. By focusing on what is allowed rather
> than
> > what is denied, we can better control and ensure trusted modules are the
> > only ones in use.
> >
> > Thanks!
> >
> > KIP:
> >
> https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=340037077
> > JIRA:
> > https://issues.apache.org/jira/browse/KAFKA-18627
> >
> > --
> > Best,
> > Xuan-Zhang Gong
> >
>
Re: KIP-1135: Deprecated "org.apache.kafka.disallowed.login.modules"
Posted by 龚宣璋 <go...@gmail.com>.
Hi everyone,
Just checking in — does anyone have any further thoughts or comments on
this discussion thread?
If there are no objections, I’ll go ahead and send out the voting
notification tomorrow.
Best regards,
Xuan-Zhang Gong
Re: KIP-1135: Deprecated "org.apache.kafka.disallowed.login.modules"
Posted by 龚宣璋 <go...@gmail.com>.
Hi TengYao
Thanks for your review.
For compatibility purposes, we may not be able to use the allowed
configuration directly at this time. "Deprecated" may not be a good
description.
I think we can change JAAS filter logic just
TengYao Chi <ki...@gmail.com> 于2025年3月6日周四 16:52写道：
> Hi Xuan-Zhang
> Thanks for the KIP. I have a few questions.
>
> TC0: It seems that we don't have default allow list in the KIP. As Chia
> mentioned, we should add a default one. Moreover, we should also update the
> "Compatibility, Deprecation, and Migration Plan" section. We should use
> default allow list for processing, not the disallowed list.
>
> TC1: Perhaps we should add javadoc for deprecated field and new filed, it
> would good for understanding.
>
> TC2: Public Interface section should also metion adding new field and
> deprecated field.
>
> Best,
> TengYao
>
> Chia-Ping Tsai <ch...@apache.org> 於 2025年3月6日 週四 下午4:32寫道：
>
> > hi Xuan-Zhang
> >
> > Thanks for this kip. Please take a look at following questions.
> >
> > cp00:
> > the description "(optional) we can deprecate
> > `org.apache.kafka.disallowed.login.m ..." seems be a little weird to me,
> > since we normally introduce a new config and deprecate the old one at the
> > same time.
> >
> > cp01:
> > could you please add the default allowed lists to the KIP?
> >
> > cp02:
> > blacklist -> disallowed list
> >
> > thanks,
> > chia-ping
> >
> >
> > On 2025/02/20 05:55:39 龚宣璋 wrote:
> > > Hey all,
> > >
> > > I would like to discuss a proposal regarding the JAAS-related
> processes.
> > > After some consideration, I believe we should adopt the approach of
> using
> > > an “allow-list” to filter modules, rather than relying on a
> > “disallow-list.”
> > >
> > > Although this KIP is simple, I believe it offers significant value in
> > terms
> > > of both security and efficiency. By focusing on what is allowed rather
> > than
> > > what is denied, we can better control and ensure trusted modules are
> the
> > > only ones in use.
> > >
> > > Thanks!
> > >
> > > KIP:
> > >
> >
> https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=340037077
> > > JIRA:
> > > https://issues.apache.org/jira/browse/KAFKA-18627
> > >
> > > --
> > > Best,
> > > Xuan-Zhang Gong
> > >
> >
>
Re: KIP-1135: Deprecated "org.apache.kafka.disallowed.login.modules"
Posted by TengYao Chi <ki...@gmail.com>.
Hi Xuan-Zhang
Thanks for the KIP. I have a few questions.
TC0: It seems that we don't have default allow list in the KIP. As Chia
mentioned, we should add a default one. Moreover, we should also update the
"Compatibility, Deprecation, and Migration Plan" section. We should use
default allow list for processing, not the disallowed list.
TC1: Perhaps we should add javadoc for deprecated field and new filed, it
would good for understanding.
TC2: Public Interface section should also metion adding new field and
deprecated field.
Best,
TengYao
Chia-Ping Tsai <ch...@apache.org> 於 2025年3月6日 週四 下午4:32寫道：
> hi Xuan-Zhang
>
> Thanks for this kip. Please take a look at following questions.
>
> cp00:
> the description "(optional) we can deprecate
> `org.apache.kafka.disallowed.login.m ..." seems be a little weird to me,
> since we normally introduce a new config and deprecate the old one at the
> same time.
>
> cp01:
> could you please add the default allowed lists to the KIP?
>
> cp02:
> blacklist -> disallowed list
>
> thanks,
> chia-ping
>
>
> On 2025/02/20 05:55:39 龚宣璋 wrote:
> > Hey all,
> >
> > I would like to discuss a proposal regarding the JAAS-related processes.
> > After some consideration, I believe we should adopt the approach of using
> > an “allow-list” to filter modules, rather than relying on a
> “disallow-list.”
> >
> > Although this KIP is simple, I believe it offers significant value in
> terms
> > of both security and efficiency. By focusing on what is allowed rather
> than
> > what is denied, we can better control and ensure trusted modules are the
> > only ones in use.
> >
> > Thanks!
> >
> > KIP:
> >
> https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=340037077
> > JIRA:
> > https://issues.apache.org/jira/browse/KAFKA-18627
> >
> > --
> > Best,
> > Xuan-Zhang Gong
> >
>