Repository navigation
feat: bundle aws-msk-iam-auth for Amazon MSK IAM auth in Kafka
#20471
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
amaechler
wants to merge
3
commits into
apache:master
Choose a base branch
from
amaechler:feature/kafka-msk-iam-auth
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
3 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
72 changes: 72 additions & 0 deletions
72
...a-extraction-namespace/src/test/java/org/apache/druid/query/lookup/AwsMskIamAuthTest.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.apache.druid.query.lookup; | ||
|
|
||
| import org.junit.jupiter.api.Assertions; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import javax.security.sasl.Sasl; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Checks that a lookup configured for {@code AWS_MSK_IAM} as documented logs in using only the AWS SDK on Druid's | ||
| * core classpath. Login happens in the consumer constructor, so no broker is needed. | ||
| */ | ||
| public class AwsMskIamAuthTest | ||
| { | ||
| private static final String LOGIN_MODULE = "software.amazon.msk.auth.iam.IAMLoginModule"; | ||
|
|
||
| @Test | ||
| public void testDefaultCredentials() throws Exception | ||
| { | ||
| createAndCloseConsumer(LOGIN_MODULE + " required;"); | ||
|
|
||
| // Construction never connects, so separately check the mechanism the SASL handshake would look up. | ||
| Assertions.assertNotNull( | ||
| Sasl.createSaslClient(new String[]{"AWS_MSK_IAM"}, null, "kafka", "localhost", Map.of(), callbacks -> {}), | ||
| "AWS_MSK_IAM SASL mechanism is not registered" | ||
| ); | ||
| } | ||
|
|
||
| /** | ||
| * Assume-role builds an {@code StsClient} at login, which reaches more of the SDK than the default chain. | ||
| */ | ||
| @Test | ||
| public void testAssumeRole() | ||
| { | ||
| createAndCloseConsumer( | ||
| LOGIN_MODULE + " required awsRoleArn=\"arn:aws:iam::123456789012:role/msk-consumer\" awsStsRegion=\"us-east-1\"" | ||
| + " awsAddDefaultProviders=\"false\";" | ||
| ); | ||
| } | ||
|
|
||
| private static void createAndCloseConsumer(final String jaasConfig) | ||
| { | ||
| final Map<String, String> kafkaProperties = Map.of( | ||
| "bootstrap.servers", "localhost:9098", | ||
| "security.protocol", "SASL_SSL", | ||
| "sasl.mechanism", "AWS_MSK_IAM", | ||
| "sasl.jaas.config", jaasConfig, | ||
| "sasl.client.callback.handler.class", "software.amazon.msk.auth.iam.IAMClientCallbackHandler" | ||
| ); | ||
|
|
||
| new KafkaLookupExtractorFactory(null, "lookup-topic", kafkaProperties).getConsumer().close(); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
73 changes: 73 additions & 0 deletions
73
...fka-indexing-service/src/test/java/org/apache/druid/indexing/kafka/AwsMskIamAuthTest.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.apache.druid.indexing.kafka; | ||
|
|
||
| import org.apache.druid.jackson.DefaultObjectMapper; | ||
| import org.junit.jupiter.api.Assertions; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| import javax.security.sasl.Sasl; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Checks that a consumer configured for {@code AWS_MSK_IAM} as documented logs in using only the AWS SDK on Druid's | ||
| * core classpath. Login happens in the consumer constructor, so no broker is needed. | ||
| */ | ||
| public class AwsMskIamAuthTest | ||
| { | ||
| private static final String LOGIN_MODULE = "software.amazon.msk.auth.iam.IAMLoginModule"; | ||
|
|
||
| @Test | ||
| public void testDefaultCredentials() throws Exception | ||
| { | ||
| createAndCloseConsumer(LOGIN_MODULE + " required;"); | ||
|
|
||
| // Construction never connects, so separately check the mechanism the SASL handshake would look up. | ||
| Assertions.assertNotNull( | ||
| Sasl.createSaslClient(new String[]{"AWS_MSK_IAM"}, null, "kafka", "localhost", Map.of(), callbacks -> {}), | ||
| "AWS_MSK_IAM SASL mechanism is not registered" | ||
| ); | ||
| } | ||
|
|
||
| /** | ||
| * Assume-role builds an {@code StsClient} at login, which reaches more of the SDK than the default chain. | ||
| */ | ||
| @Test | ||
| public void testAssumeRole() | ||
| { | ||
| createAndCloseConsumer( | ||
| LOGIN_MODULE + " required awsRoleArn=\"arn:aws:iam::123456789012:role/msk-consumer\" awsStsRegion=\"us-east-1\"" | ||
| + " awsAddDefaultProviders=\"false\";" | ||
| ); | ||
| } | ||
|
|
||
| private static void createAndCloseConsumer(final String jaasConfig) | ||
| { | ||
| final Map<String, Object> consumerProperties = Map.of( | ||
| "bootstrap.servers", "localhost:9098", | ||
| "security.protocol", "SASL_SSL", | ||
| "sasl.mechanism", "AWS_MSK_IAM", | ||
| "sasl.jaas.config", jaasConfig, | ||
| "sasl.client.callback.handler.class", "software.amazon.msk.auth.iam.IAMClientCallbackHandler" | ||
| ); | ||
|
|
||
| KafkaRecordSupplier.getKafkaConsumer(new DefaultObjectMapper(), consumerProperties, null).close(); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[P2] Default-provider SSO profiles fail at runtime
Finding: Both extension POMs exclude every transitive of aws-msk-iam-auth 2.3.9, but this release's ProfileCredentialsProvider loads software.amazon.awssdk.services.sso.auth.SsoProfileCredentialsProviderFactory for profiles using SSO fields and declares the sso and ssooidc modules explicitly. druid-aws-common in this tree supplies the shared auth, regions, and STS modules but not those SSO modules, so a user relying on the default AWS provider chain with an SSO-backed profile cannot resolve credentials and the Kafka consumer fails before authenticating.
Suggestion: Add compatible AWS SDK sso and ssooidc runtime modules to the shared classpath, or retain these plugin transitives in both extension packaging paths, and cover an SSO-backed profile in a smoke test.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, this is deliberate. The gap is not specific to this PR. Druid's own chain (
AWSCredentialsUtils.defaultAWSCredentialsProviderChain, used by S3 and Kinesis) fails on the samesso-sessionprofile with the same "the 'sso' service module must be on the class path" error, becauselib/lacks these modules.I had Claude look up some specifics around how AWS SSO works:
That said, users who need SSO can add
sso,ssooidcandaws-json-protocoltolib/in their own Druid install.ssoneedsaws-json-protocol; without it, resolution fails withNoClassDefFoundError. I verified this layout for both the plugin and Druid's chain. We could always add them todruid-aws-commonif there is demand (in a separate PR).There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Follow-up assessment
Thanks for the clarification. I rechecked the current head across all 8 changed files, including both extension POMs and Druid's existing
AWSCredentialsUtils.defaultAWSCredentialsProviderChain. The missing SSO modules are already absent from the shareddruid-aws-commonclasspath, and this PR does not change that path, so the SSO limitation is not a PR-caused regression. I am withdrawing the P2 finding; no further action is needed on this thread.Reviewed 8 of 8 changed files; this follow-up has 0 remaining findings. Static
git diff --check e855cd9c3316710361c7f2cf0b1b8331141c20ad ebf673d4c13d903eaccbe4995a2308733b7ddc32passed; no tests or builds were run.