search

aws / aws-msk-iam-auth

Enables developers to use AWS Identity and Access Management (IAM) to connect to their Amazon Managed Streaming for Apache Kafka (Amazon MSK) clusters.
Apache License 2.0
138 stars 65 forks source link

2.1.1 release includes SaslAuthenticationException regression #180

Open jamielwhite opened 1 week ago

jamielwhite commented 1 week ago

In #143, I reported an issue in which the first re-authentication failed for the OAUTHBEARER mechanism. This issue was resolved in release 2.0.3 for the case when awsRoleArn was provided. When I upgraded our apps from 2.0.3 to 2.1.1, I noticed our apps were restarting every hour due to a SaslAuthenticationException: Session too short error. The difference between the behavior now vs in #143 is that the failure occurs after one hour, not after 15 minutes when the role first expires.

I reported this in a comment on a related issue for the case where awsRoleArn is not provided, but since that error also occurs in 2.0.3 I've created this as a separate issue.

security.protocol=SASL_SSL
sasl.mechanism=OAUTHBEARER
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required awsRoleArn="<role arn>" awsStsRegion="<region>";
sasl.login.callback.handler.class=software.amazon.msk.auth.iam.IAMOAuthBearerLoginCallbackHandler