[Feature Request] Add support for AWS_MSK_IAM SASL mechanism to librdkafka. #3402
Closed
1 of 7 tasks
Comments
|
Bumping up. As of now, there are 23 +1's on this. Any thoughts on this from the maintainers of librdkafka? |
|
If you need to add a new SASL mechanism to Kafka clients you should follow the Apache Kafka KIP process by writing up a proposal and get buy-in from the open source Kafka community. There would also need to be the corresponding broker support for this mechanism to be usable by the community, and testable by client maintainers. When the KIP has been accepted you're welcome to contribute a PR to add support to librdkafka. |
|
would you be open to allow librdkafka to have some way to plug in a custom mechanism like what was suggested as option 1? the standard Java clients already support this type of behavior via JAAS and the client callback handler in the SaslConfigs class. for Java, AWS provided the JAAS config file and the callback handler. that is sufficient for the Java client to work properly. seems like a similar mechanism for librdkafka and those libraries that bind to it would be helpful for this use case as well as other SASL implementations that the community may need. |
|
@sayantacC @gokul2411s we forked this library so we could provide built-in IAM SASL auth for our downstream clients that rely on librdkafka. That fork can be found here. @edenhill we'd love to work with you to get this integrated back into master at some point. if you'd be willing, we can modify this fork to better fit your vision for the library and refactor anything that you recommend (i tried to keep it close to how you implemented other SASL mechanisms) |
garrett528
added a commit
to UrbanCompass/librdkafka
that referenced
this issue
Aug 13, 2021
AWS_MSK_IAM is a new SASL mechanism for authenticating clients to AWS MSK Kafka clusters and use IAM-based controls to set Kafka ACLs and permissions. This change provides support to allow clients to pass AWS credentials at runtime which is used to build the SASL payload and authenticate clients to IAM enabled MSK clusters. It adds a new SASL mechanism, AWS_MSK_IAM, as well as configuration options to set the following: * AWS access key id * AWS secret access key * AWS region * AWS security token The SASL handshake requires a specific payload that is described here: https://github.com/aws/aws-msk-iam-auth
garrett528
added a commit
to UrbanCompass/librdkafka
that referenced
this issue
Aug 18, 2021
AWS_MSK_IAM is a new SASL mechanism for authenticating clients to AWS MSK Kafka clusters and use IAM-based controls to set Kafka ACLs and permissions. This change provides support to allow clients to pass AWS credentials at runtime which is used to build the SASL payload and authenticate clients to IAM enabled MSK clusters. It adds a new SASL mechanism, AWS_MSK_IAM, as well as configuration options to set the following: * AWS access key id * AWS secret access key * AWS region * AWS security token The SASL handshake requires a specific payload that is described here: https://github.com/aws/aws-msk-iam-auth
garrett528
added a commit
to UrbanCompass/librdkafka
that referenced
this issue
Nov 2, 2021
AWS_MSK_IAM is a new SASL mechanism for authenticating clients to AWS MSK Kafka clusters and use IAM-based controls to set Kafka ACLs and permissions. This change provides support to allow clients to pass AWS credentials at runtime which is used to build the SASL payload and authenticate clients to IAM enabled MSK clusters. It adds a new SASL mechanism, AWS_MSK_IAM, as well as configuration options to set the following: * AWS access key id * AWS secret access key * AWS region * AWS security token The SASL handshake requires a specific payload that is described here: https://github.com/aws/aws-msk-iam-auth
garrett528
added a commit
to UrbanCompass/librdkafka
that referenced
this issue
Nov 2, 2021
* mklove: make zlib test program compilable
The test program that is used at compile-time to detect whether zlib is
available fails to compile due to `NULL` being undefined:
```
_mkltmpyos55w.c:5:20: error: use of undeclared identifier 'NULL'
z_stream *p = NULL;
^
1 error generated.
```
This means that zlib availability is only automatically detected when
using pkg-config.
Import `stddef.h` (which defines `NULL`) in the test program, allowing
zlib to be automatically detected via a compilation check.
* Travis: New secure env vars
* AppVeyor: rotate access keys
* Travis: show sha256sums of artifacts prior to deploy
* Add MSVC 140 runtimes (for packaging)
* Add 'ssl.ca.pem' property (confluentinc#2380)
* Improve nuget release script
- Verify artifact file contents and architectures.
- Verify that artifact attributes match.
- Get README, CONFIG,.. etc, from artifacts instead of local source tree
(which may not match the released version).
* Bump to version 1.8.2
(Skipping 1.8.1 due to dotnet release with that number)
* mklove: fix static bundle .a generation on osx
* mklove: portable checksum checking for downloads
* mklove: allow --source-deps-only OpenSSL builds on OSX
* Don't build ancient OSX Sierra artifacts
* Travis: reduce build minutes (tagged jobs)
* Travis: use --source-deps-only for dependencies instead of using homebrew
Homebrew is fantastically slow to update to Travis-CI, and it is burning
build credits like crazy.
* mklove: added mklove_patch
* mklove: show more of failed build logs
* mklove openssl installer: workaround build issue in 1.1.1l on osx.
* Apply OpenSSL PR 16409 patch to fix 1.1.1l build issues on OSX
* Travis: Remove -Werror from OSX worker since OpenSSL builds have quite a few warnings
* mklove: try both wget and curl for archive downloads
* Don't overwrite ssl.ca.location on OSX (confluentinc#3566)
* Travis: bump Linux base builder from trusty to xenial to circumvent ISRG cert expiry
.. which causes older versions of OpenSSL+curl to fail to download OpenSSL..
* AddOffsetsToTxn Refresh errors did not trigger coord refresh (confluentinc#3571)
* Ensure timers are started even if timeout is 0
* Transactional producer: Fix possible message loss on OUT_OF_ORDER_SEQ error (confluentinc#3575)
* Mock push_request_errors() appended the errors in reverse order
* Update list of supported KIPs
* Add rd_buf_new()
* Import cJSON v1.7.14
URL: https://github.com/DaveGamble/cJSON
Tag: v1.7.14
SHA: d2735278ed1c2e4556f53a7a782063b31331dbf7
* Added HTTP(S) client using cURL
* Add HTTP(S) client using cURL
* Fix uninitialized warning on msvc
* Remove commented-out printfs
* Remove stray license include in librdkafka vcxproj
* librdkafka.vcxproj: remove stale OpenSSL paths and enable Vcpkg manifests
* mklove: but all built deps in the same destdir and set up compiler flags accordingly
This fixes some issues when dependency B depends on dependency A, in this
case for libcurl that depends on OpenSSL, to make it find the OpenSSL
libraries, pkg-config files, etc.
* mklove: don't include STATIC_LIB_..s in BUILT_WITH
* mklove: Some autoconf versions seem to need a full path to $INSTALL
* curl: disable everything but HTTP(S)
* Added string splitter and kv splitter
* OAuth/OIDC: Add fields to client configuration (confluentinc#3510)
* Implement native Win32 IO/Queue scheduler (WSAWaitForMultipleEvents)
This removes the internal loopback connections (one per known broker)
that were previously used to trigger io-based queue wakeups.
* Add vcpkg_installed to gitignore
* Left-trim spaces from string configuration values
This makes it easier to use Bash on Windows where a prefixing / is translated
into the MinGW32 file system root.
* Mark rd_kafka_conf_kv_split as unused .. until it's used.
* rd_kafka_queue_get_background() now creates the background thread
* Added custom SASL callback queue
* Fix test flags for 0122 and 0126
* Test 0119: remove unused code
* Direct questions to the github discussions forum to keep issue load down
* Add clang-format style checking and fixing
* Add Python style checking and fixing
* Run style-checker with Github Actions
* Automatic style fixes using 'make style-fix'
* Manual style fixes of Python code
* Avoid use of FILE* BIOs to circumvent OpenSSL_Applink requirement on Windows (confluentinc#3554)
* sasl: Enable AWS_MSK_IAM SASL mechanism (confluentinc#3402)
AWS_MSK_IAM is a new SASL mechanism for
authenticating clients to AWS MSK Kafka
clusters and use IAM-based controls to
set Kafka ACLs and permissions. This change
provides support to allow clients to pass
AWS credentials at runtime which is used
to build the SASL payload and authenticate
clients to IAM enabled MSK clusters. It adds
a new SASL mechanism, AWS_MSK_IAM, as well
as configuration options to set the following:
* AWS access key id
* AWS secret access key
* AWS region
* AWS security token
The SASL handshake requires a specific payload
that is described here:
https://github.com/aws/aws-msk-iam-auth
* Add curl to doozer build
* Address comments (#5)
* sasl: Enable STS credential refresh (#7)
* Add 'ssl.ca.pem' property (confluentinc#2380)
* Updated PROPS_IDX_MAX
* Remove HEAD
* Fix compile errors
* Fix consumer
Co-authored-by: Chris Novakovic <[email protected]>
Co-authored-by: Magnus Edenhill <[email protected]>
Co-authored-by: Jing Liu <[email protected]>
|
@edenhill Any path forward on merging the fork @garrett528 created above to provide IAM support for kafka? |
|
Just noticed this comment - #3496 (comment) |
|
@sayantacC - I went looking to see if there is an open KIP for this yet. Will this be pursued further? |
|
Doesn't KIP-86 already cover the scenario of pluggable authorization providers via login and callback methods and it's just that the maintainers have chosen not to implement it? That's why it's so easy to do with the Java client. |
@garrett528 -> can you also help with the the right documentation on how to get this running using python, with the configurations as example. This will be great help. |
|
@garrett528 I've been trying to get your fork built using docker today but not having much luck. I think I need to enable the preprocessor flag |
|
Hi comunity Has anyone had success along the way? |
jacobpath
pushed a commit
to pathccm/librdkafka
that referenced
this issue
Jun 6, 2023
parent d2bc749 author garrett528 <[email protected]> 1625669334 -0400 committer Jacob Lee <[email protected]> 1686019633 -0700 gpgsig -----BEGIN SSH SIGNATURE----- U1NIU0lHAAAAAQAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ AAAAhuaXN0cDI1NgAAAEEE/KxKuQeycJHYJkNEqsJPsQqQxVl1ftFETXL0PMawe+tBCMrH AiNd2GpQHEKTqzopO72+yiqWDjpM10WrTyzXBAAAAARzc2g6AAAAA2dpdAAAAAAAAAAGc2 hhNTEyAAAAeAAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAASQAA ACBhH8xrzkQR+w6xy86JjJ6tC6udVA0Xn4VgdX3YEEZ25QAAACEA//YouC+q94g0jxjA8D tL+R+SGXR8782VjNc2vO5hS6YBAAAfoQ== -----END SSH SIGNATURE----- sasl: Enable AWS_MSK_IAM SASL mechanism (confluentinc#3402) AWS_MSK_IAM is a new SASL mechanism for authenticating clients to AWS MSK Kafka clusters and use IAM-based controls to set Kafka ACLs and permissions. This change provides support to allow clients to pass AWS credentials at runtime which is used to build the SASL payload and authenticate clients to IAM enabled MSK clusters. It adds a new SASL mechanism, AWS_MSK_IAM, as well as configuration options to set the following: * AWS access key id * AWS secret access key * AWS region * AWS security token The SASL handshake requires a specific payload that is described here: https://github.com/aws/aws-msk-iam-auth Add curl to doozer build Address comments (UrbanCompass#5) Reduce Travis-CI runtime * Reduce number of jobs when not building a tag * Run unit tests if no tag, and local quick suite (old default) when tagged. * Combine some jobs. Travis ARM64: build static lib Travis: Disable C99 for all builds but the integration test build .. since it hampers the use of assembler (asm()) on arm64. Keep session alive when receiving heartbeat responses during rebalancing add changelog message Update Changelog Add cleanup-s3.py script Move Admin request arguments to result op to make them available on merge (confluentinc#3476) Fix test 0055 now when flush() does not wait for linger.ms Adds support for buildling on illumos mklove: Use curl for module downloads .. instead of wget, since we rely on curl elsewhere. Verify checksum of source dependencies and bump to OpenSSL 1.1.1l, zstd 1.5.0 Travis: login with docker account to avoid rate-limiting Docker dotnet images have changed names, updated. rxidle and txidle were stats emitted as unsigned 64, now signed (confluentinc#3519) Fix a small error due to the unreleased lock before program exit Fix a small error due to the unreleased lock skm->lock before program exit. mklove: make zlib test program compilable The test program that is used at compile-time to detect whether zlib is available fails to compile due to `NULL` being undefined: ``` _mkltmpyos55w.c:5:20: error: use of undeclared identifier 'NULL' z_stream *p = NULL; ^ 1 error generated. ``` This means that zlib availability is only automatically detected when using pkg-config. Import `stddef.h` (which defines `NULL`) in the test program, allowing zlib to be automatically detected via a compilation check. sasl: Enable STS credential refresh (UrbanCompass#7) Define IOV_MAX as 1024 if not defined Removed check int and added debug Fixes error handling for error responses from STS (UrbanCompass#10) mklove: make zlib test program compilable The test program that is used at compile-time to detect whether zlib is available fails to compile due to `NULL` being undefined: ``` _mkltmpyos55w.c:5:20: error: use of undeclared identifier 'NULL' z_stream *p = NULL; ^ 1 error generated. ``` This means that zlib availability is only automatically detected when using pkg-config. Import `stddef.h` (which defines `NULL`) in the test program, allowing zlib to be automatically detected via a compilation check. Travis: New secure env vars AppVeyor: rotate access keys Travis: show sha256sums of artifacts prior to deploy Add MSVC 140 runtimes (for packaging) Add 'ssl.ca.pem' property (confluentinc#2380) Improve nuget release script - Verify artifact file contents and architectures. - Verify that artifact attributes match. - Get README, CONFIG,.. etc, from artifacts instead of local source tree (which may not match the released version). Bump to version 1.8.2 (Skipping 1.8.1 due to dotnet release with that number) mklove: fix static bundle .a generation on osx mklove: portable checksum checking for downloads mklove: allow --source-deps-only OpenSSL builds on OSX Don't build ancient OSX Sierra artifacts Travis: reduce build minutes (tagged jobs) Travis: use --source-deps-only for dependencies instead of using homebrew Homebrew is fantastically slow to update to Travis-CI, and it is burning build credits like crazy. mklove: added mklove_patch mklove: show more of failed build logs mklove openssl installer: workaround build issue in 1.1.1l on osx. Apply OpenSSL PR 16409 patch to fix 1.1.1l build issues on OSX Travis: Remove -Werror from OSX worker since OpenSSL builds have quite a few warnings mklove: try both wget and curl for archive downloads Don't overwrite ssl.ca.location on OSX (confluentinc#3566) Travis: bump Linux base builder from trusty to xenial to circumvent ISRG cert expiry .. which causes older versions of OpenSSL+curl to fail to download OpenSSL.. AddOffsetsToTxn Refresh errors did not trigger coord refresh (confluentinc#3571) Ensure timers are started even if timeout is 0 Transactional producer: Fix possible message loss on OUT_OF_ORDER_SEQ error (confluentinc#3575) Mock push_request_errors() appended the errors in reverse order Update list of supported KIPs Add rd_buf_new() Import cJSON v1.7.14 URL: https://github.com/DaveGamble/cJSON Tag: v1.7.14 SHA: d2735278ed1c2e4556f53a7a782063b31331dbf7 Added HTTP(S) client using cURL Add HTTP(S) client using cURL Fix uninitialized warning on msvc Remove commented-out printfs Remove stray license include in librdkafka vcxproj librdkafka.vcxproj: remove stale OpenSSL paths and enable Vcpkg manifests mklove: but all built deps in the same destdir and set up compiler flags accordingly This fixes some issues when dependency B depends on dependency A, in this case for libcurl that depends on OpenSSL, to make it find the OpenSSL libraries, pkg-config files, etc. mklove: don't include STATIC_LIB_..s in BUILT_WITH mklove: Some autoconf versions seem to need a full path to $INSTALL curl: disable everything but HTTP(S) Added string splitter and kv splitter OAuth/OIDC: Add fields to client configuration (confluentinc#3510) Implement native Win32 IO/Queue scheduler (WSAWaitForMultipleEvents) This removes the internal loopback connections (one per known broker) that were previously used to trigger io-based queue wakeups. Add vcpkg_installed to gitignore Left-trim spaces from string configuration values This makes it easier to use Bash on Windows where a prefixing / is translated into the MinGW32 file system root. Mark rd_kafka_conf_kv_split as unused .. until it's used. rd_kafka_queue_get_background() now creates the background thread Added custom SASL callback queue Fix test flags for 0122 and 0126 Test 0119: remove unused code Direct questions to the github discussions forum to keep issue load down Add clang-format style checking and fixing Add Python style checking and fixing Run style-checker with Github Actions Automatic style fixes using 'make style-fix' Manual style fixes of Python code Avoid use of FILE* BIOs to circumvent OpenSSL_Applink requirement on Windows (confluentinc#3554) Added README for fork (UrbanCompass#15) merge upstream 2022 04 08 (UrbanCompass#17) * Fix memory leak in admin requests Fix a memory leak introduces in ca1b30e in which the arguments to an admin request were not being freed. Discovered by the test suite for rust-rdkafka [0]. [0]: https://github.com/fede1024/rust-rdkafka/pull/397/checks?check_run_id=3914902373 * Fix MinGW Travis build issues by breaking test execution into a separate script * ACL Admin Apis: CreateAcls, DescribeAcls, DeleteAcls * Minor ACL API adjustments and some small code tweaks * Add ACL support to CHANGELOG * Retrieve jwt token from token provider (@jliunyu, confluentinc#3560) * Fixed typo * MsgSets with just aborted msgs raised a MSG_SIZE error, and fix backoff (confluentinc#2993) This also removes fetch backoffs on underflows (truncated responses). * test 0129: style fix * test 0105: Fix race condition * Idempotent producer: save state for removed partitions .. in case they come back. To avoid silent message loss. * Remove incorrect comment on mock API * Fix rkbuf_rkb assert on malformed JoinGroupResponse.metadata * clusterid() would fail if there were no topics in metadata (confluentinc#3620) * sasl.oauthbearer.extensions should be optional Fixes confluentinc/confluent-kafka-python#1269. * Added AK 3.1.0 to test versions * Changelog updates * Bump version to v1.9.0 * sasl.oauthbearer.scope should be optional According to the section 4.4.2 of RFC 6749, the scope is optional in the access token request in client credentials flow. And indeed, for OIDC providers that I find in the wild such as Amazon Cognito, the scope _is_ optional. If the scope is omitted from the request, then the returned access token will contain any and all scope(s) that are configured for the client. See https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2 * Fix hang in list_groups() when cluster is unavailable (confluentinc#3705) This was caused by holding on to an old broker state version that got outdated and caused an infinite loop, rather than a timeout. * Style fixes * Integration test for OIDC (confluentinc#3646) * Test for trivup * integration test * Update code style for existing code at rdkafka_sasl_oauthbearer_oidc.c * Handle review comment * tiny fix * Handle review comments * misc.c style fix * Test fixes: OIDC requires AK 3.1, not 3.0 * Test 0113: reset security.protocol when using mock cluster * Travis: use Py 3.8 (not 3.5) on Xenial builder * Travis: bump integration test from AK 2.7.0 to 2.8.1 * Fix README release wording * Improve subscribe() error documentation * Fix linger.ms/message.timeout.ms config checking (confluentinc#3709) * Replace deprecated zookeeper flag with bootstrap (@ladislavmacoun, confluentinc#3700) * Replace deprecated zookeeper flag with bootstrap Fixes: confluentinc#3699 Signed-off-by: Ladislav Macoun <[email protected]> * Add backwards compatibility Signed-off-by: Ladislav Macoun <[email protected]> * Add assertion for cmd fitting inside buffer Signed-off-by: Ladislav Macoun <[email protected]> * Increase command buffer Signed-off-by: Ladislav Macoun <[email protected]> * Save one superfluous message timeout toppar scan * Update to fedora:35 to fix the CentOS 8 build mock epel-8-x86_64 is now broken in fedora:33: https://bugzilla.redhat.com/show_bug.cgi?id=2049024 Update to fedora:35 with mock configs: centos+epel-7-x86_64 centos-stream+epel-8-x86_64 * Add link to tutorial on Confluent Developer Also fix indenting of bullet list * Grooming (compilation warnings, potential issues) Signed-off-by: Sergio Arroutbi <[email protected]> * fix: acl binding enum checks (@emasab, confluentinc#3741) * checking enums values when creating or reading AclBinding and AclBindingFilter * AclBinding destroy array function * acl binding unit tests * warnings and fix for unknown enums, test fixes * int sizes matching the read size * pointer to the correct broker * cmake: Use CMAKE_INSTALL_LIBDIR this ensures that it is portable across platforms e.g. ppc64/linux uses lib64 not lib Signed-off-by: Khem Raj <[email protected]> * Trigger op callbacks regardless for unhandled types in consume_batch_queue() et.al. (confluentinc#3263) * AppVeyor: Use Visual Studio 2019 image to build since 2015 has TLS problems The 2015 image fails to donwload openssl due to TLS 1.2 not being available, or something along those lines. * mklove: add LD_LIBRARY_PATH to libcurl builder so that runtime checks pass * Travis: build alpine & manylinux builds with --source-deps-only This avoids relying on distro installed packages, which isn't very robust. * Nuget Debian build: use --source-deps-only to avoid external dependencies * RPM test: Use ubi8 image instead of centos:8 .. since centos is no more * Curl 7.82.0 * mklove: curl now requires CoreFoundation and SystemConfiguration frameworks on osx * Test 0128: skip if there's no oauthbearer support * Test 0128: make thread-safe * Test 0077: reduce flakyness by expediting compaction * Update to zlib 1.2.12 and OpenSSL 1.1.1n * vcpkg: revoke to zlib 1.2.11 since 1.2.12 is not yet available (as vcpkg) * Travis: Disable mingw dynamic build for now (gcc breakage) GCC 11 adds a new symbol that is not available in the mingw/msys2 libstdc++, which makes it impossible to run applications that were built. Until that's fixed we disable this worker since it will fail anyway. * mklove: fix formatting of skipped pkg-config checks * Fix lock order for rk_init_lock to avoid deadlock (non-released regression) * vcpkg version bumps * Update release instructions * Make dynamic MinGW build copy DLLs instead of trying to manipulate PATH (@neptoess, confluentinc#3787) * Make dynamic MinGW build copy DLLs instead of trying to manipulate PATH * Remove tag requirement on MinGW dynamic build Co-authored-by: Bill Rose <[email protected]> * Fix regression from last PR: curl_ldflags * Reset stored offset on assign() and prevent offsets_store() for unassigned partitions * Include broker_id in offset reset logs and corresponding consumer errors (confluentinc#3785) * Txn: properly handle PRODUCER_FENCED in InitPid reply * Provide reason to broker thread wakeups in debug logs This will make troubleshooting easier * rdkafka_performance: include broker in DR printouts * Make SUBTESTS=.. match all of the subtest format string * Added file io abstraction * rdkafka_performance: cut down on the number of poll calls in full-rate mode * Added test.mock.broker.rtt * Log mock broker bootstrap.servers addresses when test.mock.num.brokers is set * Mock brokers now allow compressed ProduceRequests No decompression or validation is performed. * Made rd_buf_read|peek_iXX() type safe * SUB_TEST_SKIP() format verification * Statistics: let broker.wakeups metric cover all broker wakeups, both IO and cnds * Improved producer queue wakeups * Broker thread: don't block on IO if there are ops available * vcpkg: Update to zlib 1.2.12 * Fix some win32 compilation warnings * Proper use of rd_socket_close() on Win32 Regression during v1.9.0 development * Test 0101: missing return after Test::Skip() * seek() doc clarification (confluentinc#3004) * Documentation updates * style-check* now fails on style warnings * Automatic style fixes * Some OIDC documentation fixes * Fix for AWS_MSK_IAM * Update for new method signature Co-authored-by: Nikhil Benesch <[email protected]> Co-authored-by: Bill Rose <[email protected]> Co-authored-by: Emanuele Sabellico <[email protected]> Co-authored-by: Magnus Edenhill <[email protected]> Co-authored-by: Jing Liu <[email protected]> Co-authored-by: Matt Clarke <[email protected]> Co-authored-by: Leo Singer <[email protected]> Co-authored-by: Ladislav <[email protected]> Co-authored-by: Ladislav Snizek <[email protected]> Co-authored-by: Lance Shelton <[email protected]> Co-authored-by: Robin Moffatt <[email protected]> Co-authored-by: Sergio Arroutbi <[email protected]> Co-authored-by: Khem Raj <[email protected]> Co-authored-by: Bill Rose <[email protected]> merge upstream 2022 08 01 (UrbanCompass#19) Co-authored-by: Bill Rose <[email protected]> Co-authored-by: Magnus Edenhill <[email protected]> Co-authored-by: Nikhil Benesch <[email protected]> Co-authored-by: Emanuele Sabellico <[email protected]> Co-authored-by: Jing Liu <[email protected]> Co-authored-by: Matt Clarke <[email protected]> Co-authored-by: Leo Singer <[email protected]> Co-authored-by: Ladislav <[email protected]> Co-authored-by: Ladislav Snizek <[email protected]> Co-authored-by: Lance Shelton <[email protected]> Co-authored-by: Robin Moffatt <[email protected]> Co-authored-by: Sergio Arroutbi <[email protected]> Co-authored-by: Khem Raj <[email protected]> Co-authored-by: Bill Rose <[email protected]> Co-authored-by: Dmytro Milinevskyi <[email protected]> Co-authored-by: Mikhail Avdienko <[email protected]> Co-authored-by: wding <[email protected]> Co-authored-by: Shawn <[email protected]> Co-authored-by: ihsinme <[email protected]> Co-authored-by: Emanuele Sabellico <[email protected]> Co-authored-by: Roman Schmitz <[email protected]> Co-authored-by: Miklos Espak <[email protected]> Co-authored-by: Alice Rum <[email protected]> Co-authored-by: Eli Smaga <[email protected]>
jacobpath
pushed a commit
to pathccm/librdkafka
that referenced
this issue
Jun 6, 2023
parent d2bc749 author garrett528 <[email protected]> 1625669334 -0400 committer Jacob Lee <[email protected]> 1686019633 -0700 gpgsig -----BEGIN SSH SIGNATURE----- U1NIU0lHAAAAAQAAAH8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBvcGVuc3NoLmNvbQ AAAAhuaXN0cDI1NgAAAEEE/KxKuQeycJHYJkNEqsJPsQqQxVl1ftFETXL0PMawe+tBCMrH AiNd2GpQHEKTqzopO72+yiqWDjpM10WrTyzXBAAAAARzc2g6AAAAA2dpdAAAAAAAAAAGc2 hhNTEyAAAAeAAAACJzay1lY2RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAASQAA ACBhH8xrzkQR+w6xy86JjJ6tC6udVA0Xn4VgdX3YEEZ25QAAACEA//YouC+q94g0jxjA8D tL+R+SGXR8782VjNc2vO5hS6YBAAAfoQ== -----END SSH SIGNATURE----- sasl: Enable AWS_MSK_IAM SASL mechanism (confluentinc#3402) AWS_MSK_IAM is a new SASL mechanism for authenticating clients to AWS MSK Kafka clusters and use IAM-based controls to set Kafka ACLs and permissions. This change provides support to allow clients to pass AWS credentials at runtime which is used to build the SASL payload and authenticate clients to IAM enabled MSK clusters. It adds a new SASL mechanism, AWS_MSK_IAM, as well as configuration options to set the following: * AWS access key id * AWS secret access key * AWS region * AWS security token The SASL handshake requires a specific payload that is described here: https://github.com/aws/aws-msk-iam-auth Add curl to doozer build Address comments (UrbanCompass#5) Reduce Travis-CI runtime * Reduce number of jobs when not building a tag * Run unit tests if no tag, and local quick suite (old default) when tagged. * Combine some jobs. Travis ARM64: build static lib Travis: Disable C99 for all builds but the integration test build .. since it hampers the use of assembler (asm()) on arm64. Keep session alive when receiving heartbeat responses during rebalancing add changelog message Update Changelog Add cleanup-s3.py script Move Admin request arguments to result op to make them available on merge (confluentinc#3476) Fix test 0055 now when flush() does not wait for linger.ms Adds support for buildling on illumos mklove: Use curl for module downloads .. instead of wget, since we rely on curl elsewhere. Verify checksum of source dependencies and bump to OpenSSL 1.1.1l, zstd 1.5.0 Travis: login with docker account to avoid rate-limiting Docker dotnet images have changed names, updated. rxidle and txidle were stats emitted as unsigned 64, now signed (confluentinc#3519) Fix a small error due to the unreleased lock before program exit Fix a small error due to the unreleased lock skm->lock before program exit. mklove: make zlib test program compilable The test program that is used at compile-time to detect whether zlib is available fails to compile due to `NULL` being undefined: ``` _mkltmpyos55w.c:5:20: error: use of undeclared identifier 'NULL' z_stream *p = NULL; ^ 1 error generated. ``` This means that zlib availability is only automatically detected when using pkg-config. Import `stddef.h` (which defines `NULL`) in the test program, allowing zlib to be automatically detected via a compilation check. sasl: Enable STS credential refresh (UrbanCompass#7) Define IOV_MAX as 1024 if not defined Removed check int and added debug Fixes error handling for error responses from STS (UrbanCompass#10) mklove: make zlib test program compilable The test program that is used at compile-time to detect whether zlib is available fails to compile due to `NULL` being undefined: ``` _mkltmpyos55w.c:5:20: error: use of undeclared identifier 'NULL' z_stream *p = NULL; ^ 1 error generated. ``` This means that zlib availability is only automatically detected when using pkg-config. Import `stddef.h` (which defines `NULL`) in the test program, allowing zlib to be automatically detected via a compilation check. Travis: New secure env vars AppVeyor: rotate access keys Travis: show sha256sums of artifacts prior to deploy Add MSVC 140 runtimes (for packaging) Add 'ssl.ca.pem' property (confluentinc#2380) Improve nuget release script - Verify artifact file contents and architectures. - Verify that artifact attributes match. - Get README, CONFIG,.. etc, from artifacts instead of local source tree (which may not match the released version). Bump to version 1.8.2 (Skipping 1.8.1 due to dotnet release with that number) mklove: fix static bundle .a generation on osx mklove: portable checksum checking for downloads mklove: allow --source-deps-only OpenSSL builds on OSX Don't build ancient OSX Sierra artifacts Travis: reduce build minutes (tagged jobs) Travis: use --source-deps-only for dependencies instead of using homebrew Homebrew is fantastically slow to update to Travis-CI, and it is burning build credits like crazy. mklove: added mklove_patch mklove: show more of failed build logs mklove openssl installer: workaround build issue in 1.1.1l on osx. Apply OpenSSL PR 16409 patch to fix 1.1.1l build issues on OSX Travis: Remove -Werror from OSX worker since OpenSSL builds have quite a few warnings mklove: try both wget and curl for archive downloads Don't overwrite ssl.ca.location on OSX (confluentinc#3566) Travis: bump Linux base builder from trusty to xenial to circumvent ISRG cert expiry .. which causes older versions of OpenSSL+curl to fail to download OpenSSL.. AddOffsetsToTxn Refresh errors did not trigger coord refresh (confluentinc#3571) Ensure timers are started even if timeout is 0 Transactional producer: Fix possible message loss on OUT_OF_ORDER_SEQ error (confluentinc#3575) Mock push_request_errors() appended the errors in reverse order Update list of supported KIPs Add rd_buf_new() Import cJSON v1.7.14 URL: https://github.com/DaveGamble/cJSON Tag: v1.7.14 SHA: d2735278ed1c2e4556f53a7a782063b31331dbf7 Added HTTP(S) client using cURL Add HTTP(S) client using cURL Fix uninitialized warning on msvc Remove commented-out printfs Remove stray license include in librdkafka vcxproj librdkafka.vcxproj: remove stale OpenSSL paths and enable Vcpkg manifests mklove: but all built deps in the same destdir and set up compiler flags accordingly This fixes some issues when dependency B depends on dependency A, in this case for libcurl that depends on OpenSSL, to make it find the OpenSSL libraries, pkg-config files, etc. mklove: don't include STATIC_LIB_..s in BUILT_WITH mklove: Some autoconf versions seem to need a full path to $INSTALL curl: disable everything but HTTP(S) Added string splitter and kv splitter OAuth/OIDC: Add fields to client configuration (confluentinc#3510) Implement native Win32 IO/Queue scheduler (WSAWaitForMultipleEvents) This removes the internal loopback connections (one per known broker) that were previously used to trigger io-based queue wakeups. Add vcpkg_installed to gitignore Left-trim spaces from string configuration values This makes it easier to use Bash on Windows where a prefixing / is translated into the MinGW32 file system root. Mark rd_kafka_conf_kv_split as unused .. until it's used. rd_kafka_queue_get_background() now creates the background thread Added custom SASL callback queue Fix test flags for 0122 and 0126 Test 0119: remove unused code Direct questions to the github discussions forum to keep issue load down Add clang-format style checking and fixing Add Python style checking and fixing Run style-checker with Github Actions Automatic style fixes using 'make style-fix' Manual style fixes of Python code Avoid use of FILE* BIOs to circumvent OpenSSL_Applink requirement on Windows (confluentinc#3554) Added README for fork (UrbanCompass#15) merge upstream 2022 04 08 (UrbanCompass#17) * Fix memory leak in admin requests Fix a memory leak introduces in ca1b30e in which the arguments to an admin request were not being freed. Discovered by the test suite for rust-rdkafka [0]. [0]: https://github.com/fede1024/rust-rdkafka/pull/397/checks?check_run_id=3914902373 * Fix MinGW Travis build issues by breaking test execution into a separate script * ACL Admin Apis: CreateAcls, DescribeAcls, DeleteAcls * Minor ACL API adjustments and some small code tweaks * Add ACL support to CHANGELOG * Retrieve jwt token from token provider (@jliunyu, confluentinc#3560) * Fixed typo * MsgSets with just aborted msgs raised a MSG_SIZE error, and fix backoff (confluentinc#2993) This also removes fetch backoffs on underflows (truncated responses). * test 0129: style fix * test 0105: Fix race condition * Idempotent producer: save state for removed partitions .. in case they come back. To avoid silent message loss. * Remove incorrect comment on mock API * Fix rkbuf_rkb assert on malformed JoinGroupResponse.metadata * clusterid() would fail if there were no topics in metadata (confluentinc#3620) * sasl.oauthbearer.extensions should be optional Fixes confluentinc/confluent-kafka-python#1269. * Added AK 3.1.0 to test versions * Changelog updates * Bump version to v1.9.0 * sasl.oauthbearer.scope should be optional According to the section 4.4.2 of RFC 6749, the scope is optional in the access token request in client credentials flow. And indeed, for OIDC providers that I find in the wild such as Amazon Cognito, the scope _is_ optional. If the scope is omitted from the request, then the returned access token will contain any and all scope(s) that are configured for the client. See https://datatracker.ietf.org/doc/html/rfc6749#section-4.4.2 * Fix hang in list_groups() when cluster is unavailable (confluentinc#3705) This was caused by holding on to an old broker state version that got outdated and caused an infinite loop, rather than a timeout. * Style fixes * Integration test for OIDC (confluentinc#3646) * Test for trivup * integration test * Update code style for existing code at rdkafka_sasl_oauthbearer_oidc.c * Handle review comment * tiny fix * Handle review comments * misc.c style fix * Test fixes: OIDC requires AK 3.1, not 3.0 * Test 0113: reset security.protocol when using mock cluster * Travis: use Py 3.8 (not 3.5) on Xenial builder * Travis: bump integration test from AK 2.7.0 to 2.8.1 * Fix README release wording * Improve subscribe() error documentation * Fix linger.ms/message.timeout.ms config checking (confluentinc#3709) * Replace deprecated zookeeper flag with bootstrap (@ladislavmacoun, confluentinc#3700) * Replace deprecated zookeeper flag with bootstrap Fixes: confluentinc#3699 Signed-off-by: Ladislav Macoun <[email protected]> * Add backwards compatibility Signed-off-by: Ladislav Macoun <[email protected]> * Add assertion for cmd fitting inside buffer Signed-off-by: Ladislav Macoun <[email protected]> * Increase command buffer Signed-off-by: Ladislav Macoun <[email protected]> * Save one superfluous message timeout toppar scan * Update to fedora:35 to fix the CentOS 8 build mock epel-8-x86_64 is now broken in fedora:33: https://bugzilla.redhat.com/show_bug.cgi?id=2049024 Update to fedora:35 with mock configs: centos+epel-7-x86_64 centos-stream+epel-8-x86_64 * Add link to tutorial on Confluent Developer Also fix indenting of bullet list * Grooming (compilation warnings, potential issues) Signed-off-by: Sergio Arroutbi <[email protected]> * fix: acl binding enum checks (@emasab, confluentinc#3741) * checking enums values when creating or reading AclBinding and AclBindingFilter * AclBinding destroy array function * acl binding unit tests * warnings and fix for unknown enums, test fixes * int sizes matching the read size * pointer to the correct broker * cmake: Use CMAKE_INSTALL_LIBDIR this ensures that it is portable across platforms e.g. ppc64/linux uses lib64 not lib Signed-off-by: Khem Raj <[email protected]> * Trigger op callbacks regardless for unhandled types in consume_batch_queue() et.al. (confluentinc#3263) * AppVeyor: Use Visual Studio 2019 image to build since 2015 has TLS problems The 2015 image fails to donwload openssl due to TLS 1.2 not being available, or something along those lines. * mklove: add LD_LIBRARY_PATH to libcurl builder so that runtime checks pass * Travis: build alpine & manylinux builds with --source-deps-only This avoids relying on distro installed packages, which isn't very robust. * Nuget Debian build: use --source-deps-only to avoid external dependencies * RPM test: Use ubi8 image instead of centos:8 .. since centos is no more * Curl 7.82.0 * mklove: curl now requires CoreFoundation and SystemConfiguration frameworks on osx * Test 0128: skip if there's no oauthbearer support * Test 0128: make thread-safe * Test 0077: reduce flakyness by expediting compaction * Update to zlib 1.2.12 and OpenSSL 1.1.1n * vcpkg: revoke to zlib 1.2.11 since 1.2.12 is not yet available (as vcpkg) * Travis: Disable mingw dynamic build for now (gcc breakage) GCC 11 adds a new symbol that is not available in the mingw/msys2 libstdc++, which makes it impossible to run applications that were built. Until that's fixed we disable this worker since it will fail anyway. * mklove: fix formatting of skipped pkg-config checks * Fix lock order for rk_init_lock to avoid deadlock (non-released regression) * vcpkg version bumps * Update release instructions * Make dynamic MinGW build copy DLLs instead of trying to manipulate PATH (@neptoess, confluentinc#3787) * Make dynamic MinGW build copy DLLs instead of trying to manipulate PATH * Remove tag requirement on MinGW dynamic build Co-authored-by: Bill Rose <[email protected]> * Fix regression from last PR: curl_ldflags * Reset stored offset on assign() and prevent offsets_store() for unassigned partitions * Include broker_id in offset reset logs and corresponding consumer errors (confluentinc#3785) * Txn: properly handle PRODUCER_FENCED in InitPid reply * Provide reason to broker thread wakeups in debug logs This will make troubleshooting easier * rdkafka_performance: include broker in DR printouts * Make SUBTESTS=.. match all of the subtest format string * Added file io abstraction * rdkafka_performance: cut down on the number of poll calls in full-rate mode * Added test.mock.broker.rtt * Log mock broker bootstrap.servers addresses when test.mock.num.brokers is set * Mock brokers now allow compressed ProduceRequests No decompression or validation is performed. * Made rd_buf_read|peek_iXX() type safe * SUB_TEST_SKIP() format verification * Statistics: let broker.wakeups metric cover all broker wakeups, both IO and cnds * Improved producer queue wakeups * Broker thread: don't block on IO if there are ops available * vcpkg: Update to zlib 1.2.12 * Fix some win32 compilation warnings * Proper use of rd_socket_close() on Win32 Regression during v1.9.0 development * Test 0101: missing return after Test::Skip() * seek() doc clarification (confluentinc#3004) * Documentation updates * style-check* now fails on style warnings * Automatic style fixes * Some OIDC documentation fixes * Fix for AWS_MSK_IAM * Update for new method signature Co-authored-by: Nikhil Benesch <[email protected]> Co-authored-by: Bill Rose <[email protected]> Co-authored-by: Emanuele Sabellico <[email protected]> Co-authored-by: Magnus Edenhill <[email protected]> Co-authored-by: Jing Liu <[email protected]> Co-authored-by: Matt Clarke <[email protected]> Co-authored-by: Leo Singer <[email protected]> Co-authored-by: Ladislav <[email protected]> Co-authored-by: Ladislav Snizek <[email protected]> Co-authored-by: Lance Shelton <[email protected]> Co-authored-by: Robin Moffatt <[email protected]> Co-authored-by: Sergio Arroutbi <[email protected]> Co-authored-by: Khem Raj <[email protected]> Co-authored-by: Bill Rose <[email protected]> merge upstream 2022 08 01 (UrbanCompass#19) Co-authored-by: Bill Rose <[email protected]> Co-authored-by: Magnus Edenhill <[email protected]> Co-authored-by: Nikhil Benesch <[email protected]> Co-authored-by: Emanuele Sabellico <[email protected]> Co-authored-by: Jing Liu <[email protected]> Co-authored-by: Matt Clarke <[email protected]> Co-authored-by: Leo Singer <[email protected]> Co-authored-by: Ladislav <[email protected]> Co-authored-by: Ladislav Snizek <[email protected]> Co-authored-by: Lance Shelton <[email protected]> Co-authored-by: Robin Moffatt <[email protected]> Co-authored-by: Sergio Arroutbi <[email protected]> Co-authored-by: Khem Raj <[email protected]> Co-authored-by: Bill Rose <[email protected]> Co-authored-by: Dmytro Milinevskyi <[email protected]> Co-authored-by: Mikhail Avdienko <[email protected]> Co-authored-by: wding <[email protected]> Co-authored-by: Shawn <[email protected]> Co-authored-by: ihsinme <[email protected]> Co-authored-by: Emanuele Sabellico <[email protected]> Co-authored-by: Roman Schmitz <[email protected]> Co-authored-by: Miklos Espak <[email protected]> Co-authored-by: Alice Rum <[email protected]> Co-authored-by: Eli Smaga <[email protected]>
|
Does KIP-86 only apply to the Java implementation? Would there be any benefit/movement in opening a new issue requesting KIP-86 to be implemented? With that in place @sayantacC can provide a Python equivalent to aws-msk-iam-auth. |
|
Asking if there has been any further effort/success implementing IAM support for librdkafka per https://cwiki.apache.org/confluence/display/kafka/kip-86%3a+configurable+sasl+callback+handlers |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
AWS recently introduced a SASL mechanism for AWS_MSK_IAM that allows Kafka clients to handle authentication and authorization with MSK clusters through AWS IAM. AWS launched a java based plugin aws-msk-iam-auth for integrating AWS_MSK_IAM as a SASL mechanism for JVM based clients. We (from AWS) would like to work with you to add support for AWS_MSK_IAM as a SASL mechanism in librdkafka. This issue was filed as a follow up from the discussion thread.
Based on initial exploration, we have identified two possible approaches:
We would love to learn if there are other possible approaches and your thoughts on which one to take. Also, any suggestions on next steps would be great.
How to reproduce
Not filling this in as it is a feature request.
Checklist
Please provide the following information:
> 2.4debug=..as necessary) from librdkafkaThe text was updated successfully, but these errors were encountered: