[jira] [Commented] (KAFKA-20184) jose4j marked as compileOnly in clients module causes ClassNotFoundException at runtime for OAuth authentication

["Loïc Greffier (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-20184?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120892#comment-18120892 ] 

Loïc Greffier commented on KAFKA-20184:
---------------------------------------

Hit the same problem recently after upgrading to Kafka Clients 4.3.1. As suggested in the [GitHub Pull Request #21518|https://github.com/apache/kafka/pull/21518], setting:
{code:java}
sasl.oauthbearer.jwt.validator.class=org.apache.kafka.common.security.oauthbearer.ClientJwtValidator{code}
worked like a charm for me.

> jose4j marked as compileOnly in clients module causes ClassNotFoundException at runtime for OAuth authentication
> ----------------------------------------------------------------------------------------------------------------
>
>                 Key: KAFKA-20184
>                 URL: https://issues.apache.org/jira/browse/KAFKA-20184
>             Project: Kafka
>          Issue Type: Bug
>          Components: clients
>    Affects Versions: 3.1.0
>            Reporter: Christian Semaan
>            Assignee: yookibaek
>            Priority: Major
>              Labels: build, client, dependancy, oauth
>
> The `jose4j` library is currently marked as `compileOnly` in the `:clients` module dependency configuration https://github.com/apache/kafka/blob/4.1/build.gradle#L1819, with a comment stating "only used by broker". However, this is incorrect and causes runtime issues.
>  
> OAuth implementation classes are in the clients module, not just broker: * org.apache.kafka.common.security.oauthbearer.internals.secured.CloseableVerificationKeyResolver (interface extending jose4j's VerificationKeyResolver)
>  * org.apache.kafka.common.security.oauthbearer.internals.secured.JwksFileVerificationKeyResolver
>  * org.apache.kafka.common.security.oauthbearer.internals.secured.RefreshingHttpsJwksVerificationKeyResolver
> Impact: 
> Runtime Failure: When Kafka clients are used with SASL/OAUTHBEARER authentication, the application will encounter `ClassNotFoundException` or `NoClassDefFoundError` for jose4j classes at runtime unless users manually add jose4j as a dependency to their applications.
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)