[jira] [Commented] (KAFKA-13848) Clients remaing connected after SASL re-authentication fails

["Andras Csaki (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-13848?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17526248#comment-17526248 ] 

Andras Csaki commented on KAFKA-13848:
--------------------------------------

Please assign this to me.

My fix is underway, there's an easy way to do it in SaslServerAuthenticator#calcCompletionTimesAndReturnSessionLifetimeMs but I'm struggling with writing the tests either in SaslServerAuthenticatorTest or in SaslAuthenticatorTest .

With SaslServerAuthenticatorTest my main issue is that I have to walk through the state machine thus making the test not focused enough and hard to follow. With SaslAuthenticatorTest, I cannot seem to parse responses to at least assert that SaslAuthenticateResponse#sessionLifetimeMs is set to a non-null value. Another way to make this more integration like test more explicit would be to make NioEchoServer emulate SocketServer's behavior by closing the channel and assert for that. (NetworkTestUtils#waitForChannelClose)

Please advise how it's best to test this.

> Clients remaing connected after SASL re-authentication fails
> ------------------------------------------------------------
>
>                 Key: KAFKA-13848
>                 URL: https://issues.apache.org/jira/browse/KAFKA-13848
>             Project: Kafka
>          Issue Type: Bug
>          Components: clients
>    Affects Versions: 3.1.0
>         Environment: https://github.com/acsaki/kafka-sasl-reauth
>            Reporter: Andras Csaki
>            Priority: Minor
>              Labels: Authentication, OAuth2, SASL
>
> Clients remain connected and able to produce or consume despite an expired OAUTHBEARER token.
> The problem can be reproduced using the https://github.com/acsaki/kafka-sasl-reauth project by starting the embedded OAuth2 server and Kafka, then running the long running consumer in OAuthBearerTest and then killing the OAuth2 server thus making the client unable to re-authenticate.
> Root cause seems to be SaslServerAuthenticator#calcCompletionTimesAndReturnSessionLifetimeMs failing to set ReauthInfo#sessionExpirationTimeNanos when tokens have already expired (when session life time goes negative), in turn causing KafkaChannel#serverAuthenticationSessionExpired returning false and finally SocketServer not closing the channel.
> The issue is observed with OAUTHBEARER but seems to have a wider impact on SASL re-authentication.



--
This message was sent by Atlassian Jira
(v8.20.7#820007)