Delegation tokens are created by a super user and allows a connection to kafka to authenticate as a specific user.
Shotover creates them to allow proxying scram connections which would otherwise be unable to be proxied.
The token task in scram_over_mtls.rs creates delegation tokens when the transforms request them.
It will cache the token and fetch new tokens if they are not in the cache yet.
Currently the hmac field stores the raw bytes of the hmac, in a Vec<u8>.
This PR changes the hmac field to instead store the base64 encoding of the hmac, in a StrBytes.
This is more efficient as we dont need to convert to base64 every time we use the hmac to login with token.
This PR completes a TODO left in the code from https://github.com/shotover/shotover-proxy/pull/1626
Delegation tokens are created by a super user and allows a connection to kafka to authenticate as a specific user. Shotover creates them to allow proxying scram connections which would otherwise be unable to be proxied.
The token task in scram_over_mtls.rs creates delegation tokens when the transforms request them. It will cache the token and fetch new tokens if they are not in the cache yet.
The tokens are stored in a type called
DelegationToken
. This contains thetoken_id
which acts as the tokens username and thehmac
which acts as the tokens password. https://github.com/shotover/shotover-proxy/blob/c1331f8944a1d2b1b005bfd6f728aecfd9b5154c/shotover/src/transforms/kafka/sink_cluster/scram_over_mtls.rs#L328-L333Currently the
hmac
field stores the raw bytes of the hmac, in aVec<u8>
. This PR changes thehmac
field to instead store the base64 encoding of the hmac, in aStrBytes
.This is more efficient as we dont need to convert to base64 every time we use the hmac to login with token.