You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "mimaison (via GitHub)" <gi...@apache.org> on 2024/05/28 19:49:31 UTC
[PR] MINOR: Delete KafkaSecurityConfigs class [kafka]
mimaison opened a new pull request, #16113:
URL: https://github.com/apache/kafka/pull/16113
This class only contains aliases for existing configurations defined in other files. These aliases, using in some cases slightly different names, are not bringing us much and instead can cause confusion.
### Committer Checklist (excluded from commit message)
- [ ] Verify design and implementation
- [ ] Verify test coverage and CI build status
- [ ] Verify documentation (including upgrade notes)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Delete KafkaSecurityConfigs class [kafka]
Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 merged PR #16113:
URL: https://github.com/apache/kafka/pull/16113
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Delete KafkaSecurityConfigs class [kafka]
Posted by "OmniaGM (via GitHub)" <gi...@apache.org>.
OmniaGM commented on code in PR #16113:
URL: https://github.com/apache/kafka/pull/16113#discussion_r1618857435
##########
clients/src/main/java/org/apache/kafka/common/config/internals/BrokerSecurityConfigs.java:
##########
@@ -30,48 +33,40 @@
public class BrokerSecurityConfigs {
public static final String PRINCIPAL_BUILDER_CLASS_CONFIG = "principal.builder.class";
- public static final String SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES_CONFIG = "sasl.kerberos.principal.to.local.rules";
- public static final String SSL_CLIENT_AUTH_CONFIG = "ssl.client.auth";
- public static final String SASL_ENABLED_MECHANISMS_CONFIG = "sasl.enabled.mechanisms";
- public static final String SASL_SERVER_CALLBACK_HANDLER_CLASS = "sasl.server.callback.handler.class";
public static final String SSL_PRINCIPAL_MAPPING_RULES_CONFIG = "ssl.principal.mapping.rules";
- public static final String CONNECTIONS_MAX_REAUTH_MS = "connections.max.reauth.ms";
- public static final long DEFAULT_CONNECTIONS_MAX_REAUTH_MS = 0L;
- public static final int DEFAULT_SASL_SERVER_MAX_RECEIVE_SIZE = 524288;
- public static final String SASL_SERVER_MAX_RECEIVE_SIZE_CONFIG = "sasl.server.max.receive.size";
- public static final String SSL_ALLOW_DN_CHANGES_CONFIG = "ssl.allow.dn.changes";
- public static final boolean DEFAULT_SSL_ALLOW_DN_CHANGES_VALUE = false;
- public static final String SSL_ALLOW_SAN_CHANGES_CONFIG = "ssl.allow.san.changes";
- public static final boolean DEFAULT_SSL_ALLOW_SAN_CHANGES_VALUE = false;
- public static final String PRINCIPAL_BUILDER_CLASS_DOC = "The fully qualified name of a class that implements the " +
- "KafkaPrincipalBuilder interface, which is used to build the KafkaPrincipal object used during " +
- "authorization. If no principal builder is defined, the default behavior depends " +
- "on the security protocol in use. For SSL authentication, the principal will be derived using the " +
- "rules defined by <code>" + SSL_PRINCIPAL_MAPPING_RULES_CONFIG + "</code> applied on the distinguished " +
- "name from the client certificate if one is provided; otherwise, if client authentication is not required, " +
- "the principal name will be ANONYMOUS. For SASL authentication, the principal will be derived using the " +
- "rules defined by <code>" + SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES_CONFIG + "</code> if GSSAPI is in use, " +
- "and the SASL authentication ID for other mechanisms. For PLAINTEXT, the principal will be ANONYMOUS.";
+ public static final String SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES_CONFIG = "sasl.kerberos.principal.to.local.rules";
+ public static final List<String> DEFAULT_SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES = Collections.singletonList("DEFAULT");
Review Comment:
Can we use `DEFAULT_SSL_PRINCIPAL_MAPPING_RULES` instead of hardcoded `DEFAULT` here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Delete KafkaSecurityConfigs class [kafka]
Posted by "mimaison (via GitHub)" <gi...@apache.org>.
mimaison commented on code in PR #16113:
URL: https://github.com/apache/kafka/pull/16113#discussion_r1618975036
##########
clients/src/main/java/org/apache/kafka/common/config/internals/BrokerSecurityConfigs.java:
##########
@@ -30,48 +33,40 @@
public class BrokerSecurityConfigs {
public static final String PRINCIPAL_BUILDER_CLASS_CONFIG = "principal.builder.class";
- public static final String SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES_CONFIG = "sasl.kerberos.principal.to.local.rules";
- public static final String SSL_CLIENT_AUTH_CONFIG = "ssl.client.auth";
- public static final String SASL_ENABLED_MECHANISMS_CONFIG = "sasl.enabled.mechanisms";
- public static final String SASL_SERVER_CALLBACK_HANDLER_CLASS = "sasl.server.callback.handler.class";
public static final String SSL_PRINCIPAL_MAPPING_RULES_CONFIG = "ssl.principal.mapping.rules";
- public static final String CONNECTIONS_MAX_REAUTH_MS = "connections.max.reauth.ms";
- public static final long DEFAULT_CONNECTIONS_MAX_REAUTH_MS = 0L;
- public static final int DEFAULT_SASL_SERVER_MAX_RECEIVE_SIZE = 524288;
- public static final String SASL_SERVER_MAX_RECEIVE_SIZE_CONFIG = "sasl.server.max.receive.size";
- public static final String SSL_ALLOW_DN_CHANGES_CONFIG = "ssl.allow.dn.changes";
- public static final boolean DEFAULT_SSL_ALLOW_DN_CHANGES_VALUE = false;
- public static final String SSL_ALLOW_SAN_CHANGES_CONFIG = "ssl.allow.san.changes";
- public static final boolean DEFAULT_SSL_ALLOW_SAN_CHANGES_VALUE = false;
- public static final String PRINCIPAL_BUILDER_CLASS_DOC = "The fully qualified name of a class that implements the " +
- "KafkaPrincipalBuilder interface, which is used to build the KafkaPrincipal object used during " +
- "authorization. If no principal builder is defined, the default behavior depends " +
- "on the security protocol in use. For SSL authentication, the principal will be derived using the " +
- "rules defined by <code>" + SSL_PRINCIPAL_MAPPING_RULES_CONFIG + "</code> applied on the distinguished " +
- "name from the client certificate if one is provided; otherwise, if client authentication is not required, " +
- "the principal name will be ANONYMOUS. For SASL authentication, the principal will be derived using the " +
- "rules defined by <code>" + SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES_CONFIG + "</code> if GSSAPI is in use, " +
- "and the SASL authentication ID for other mechanisms. For PLAINTEXT, the principal will be ANONYMOUS.";
+ public static final String SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES_CONFIG = "sasl.kerberos.principal.to.local.rules";
+ public static final List<String> DEFAULT_SASL_KERBEROS_PRINCIPAL_TO_LOCAL_RULES = Collections.singletonList("DEFAULT");
Review Comment:
Yes, done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] MINOR: Delete KafkaSecurityConfigs class [kafka]
Posted by "chia7712 (via GitHub)" <gi...@apache.org>.
chia7712 commented on PR #16113:
URL: https://github.com/apache/kafka/pull/16113#issuecomment-2137258980
We had a discussion for that before (https://github.com/apache/kafka/pull/15656#discussion_r1554518847)
+1 to remove it but it would be great that @OmniaGM can take a look :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org