REST proxy SASL OIDC authentication #731
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
matyaskuti
changed the title
matyaskuti
force-pushed
the
matyaskuti/rest_proxy_sasl_oidc_authentication
branch
10 times, most recently
from
c4bd613 to
f1bfc7e
Compare
Handle OAuth/OIDC (Bearer token) auth headers, and use them when instantiating Kafka clients (with the exception of backups for now). Basic authentication behaviour is unchanged, just extracted and unittested.
matyaskuti
force-pushed
the
matyaskuti/rest_proxy_sasl_oidc_authentication
branch
from
f1bfc7e to
b19cf19
Compare
Potentially producer and consumer clients could go into a retry-loop until the idle proxy janitor cleans up the As discussed offline, I'll modify the current |
matyaskuti
force-pushed
the
matyaskuti/rest_proxy_sasl_oidc_authentication
branch
4 times, most recently
from
9029b14 to
b191fb0
Compare
matyaskuti
force-pushed
the
matyaskuti/rest_proxy_sasl_oidc_authentication
branch
2 times, most recently
from
1db9235 to
662078f
Compare
jjaakola-aiven
previously approved these changes
Oct 13, 2023
matyaskuti
force-pushed
the
matyaskuti/rest_proxy_sasl_oidc_authentication
branch
from
662078f to
5de666d
Compare
Due to the behaviour of the Kafka clients, we want to avoid them going into a retry loop in case of an expired OAuth token. The current proxy janitor _would_ clean them up eventually but this is behaviour to be avoided. Thus the proxy janitor is extended to clean up proxies that have auth tokens expiring within a "tolerance" amount of time. To extract the expiry time (`exp` claim) from an OAuth token, the `pyjwt` library is used. With this action we do not verify the token signature (which would not be possible without knowing the signing public key). Normally this would present the issue of tokens that have been tampered with and not re-signed. However, when using a token for the first time, the Karapace REST proxy instantiates a Kafka admin client, which results in immediate verification of the token by Kafka. So even if the expiration time has been maliciously changed, the connection will be refused by Kafka, resulting in an Unauthorized response from Karapace to its client.
matyaskuti
force-pushed
the
matyaskuti/rest_proxy_sasl_oidc_authentication
branch
from
5de666d to
c350775
Compare
jjaakola-aiven
approved these changes
Oct 13, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
About this change - What it does
OAuth credentials pass-through:
Authorizationheader has aBearertoken, will create Kafka clients with theOAUTHBEARERSASL mechanism and pass the token through to themProxy janitor extension:
pyjwtis used overpython-josedue to its smaller footprint - any future switch (eg. due to the need to actually verify credentials and use JWK) is trivial (switch dependencies, modify imports) due topython-josebuilding onpyjwtand having identical interfaces for the features added nowWhy this way
Preserve the current auth behaviour without duplicating the client creation, make the decision purely based on the incoming HTTP requests.