[I] Kafka gateway: SASL SCRAM and OAUTHBEARER [iggy]

["krishvishal (via GitHub)" <gi...@apache.org>]

krishvishal opened a new issue, #4512:
URL: https://github.com/apache/iggy/issues/4512

   Follow-up to #3549, which shipped PLAIN.
   
   ## Summary
   
   PLAIN is the only SASL mechanism. A client set to SCRAM or OAUTHBEARER gets `UNSUPPORTED_SASL_MECHANISM` (33) and cannot connect. It works only after a switch to PLAIN, which is a client configuration change.
   
   Who hits it:
   
   - SCRAM: MSK, Aiven (SCRAM-SHA-256 and SCRAM-SHA-512 are on by default once SASL is on), Strimzi `KafkaUser` resources and Redpanda.
   - OAUTHBEARER: Confluent Cloud OAuth, Azure Event Hubs, Strimzi OAuth, and MSK IAM through signer libraries.
   - GSSAPI: Kerberos sites. With SASL on and no `sasl.mechanisms`, librdkafka picks GSSAPI.
   
   ## Open question
   
   `gateways/kafka/docs/AUTHENTICATION.md` ("Why SCRAM is out") rules SCRAM out. Iggy stores one Argon2 hash per user, and SCRAM needs keys derived with PBKDF2. Where do SCRAM credentials live: in a replicated credential table in Iggy, which is a server change, or in a store in the gateway?
   
   ## Scope
   
   - [ ] OAUTHBEARER: test the JWT against a JWKS endpoint, with issuer and audience required, and map a claim to an Iggy user
   - [ ] OAUTHBEARER: send `session_lifetime_ms`, so clients authenticate again before the token expires (KIP-368)
   - [ ] SCRAM-SHA-256 and SCRAM-SHA-512 with one salted credential per user, after the open question is settled
   - [ ] DescribeUserScramCredentials (50) and AlterUserScramCredentials (51). `kafka-configs --add-config SCRAM-SHA-512=...` and the Strimzi User Operator use them
   - [ ] GSSAPI only on request
   - [ ] Update `gateways/kafka/docs/AUTHENTICATION.md`
   
   ## Acceptance criteria
   
   - [ ] The Java client, librdkafka and franz-go authenticate with OAUTHBEARER against a test identity provider
   - [ ] The same clients authenticate with SCRAM-SHA-256 and SCRAM-SHA-512
   - [ ] A client authenticates again before its token expires, and keeps its connection
   
   ## References
   
   - MSK: https://docs.amazonaws.cn/en_us/AWSCloudFormation/latest/UserGuide/aws-properties-msk-cluster-sasl.html
   - Aiven: https://aiven.io/docs/products/kafka/howto/kafka-sasl-auth.html
   - Google: https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/authn-types-kafka
   - Azure Event Hubs: https://learn.microsoft.com/en-us/azure/event-hubs/apache-kafka-configurations
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org