Aiven-Open / Aiven-Open/karapace
When Karapace schema registry has OIDC configured, schema backed requests to Karapace REST fail
- Dominant language
- Python
- Stars
- 634
- Forks
- 110
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 4
Description
# What happened?
When both OIDC and basicAuth are enabled at the same time within the schema-registry back-end, then all client requests providing basicAuth and OIDC will break.
Ideally we wanted the Schema-Registry to authenticate with the token provided from SchemaRest, but if I'm not mistaken that functionality is currently not supported?
We are successfully sending requests from an external client (OIDC) -> Karapace Rest -> KafkaSASL with JSON
```
curl -k \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/vnd.kafka.json.v2+json" \
-X POST "https://$REST_HOST/topics/$TOPIC" \
-d '{
"records": [
{
"value": {
"age": "'"$RANDOM"'"
}
}
]
}'
```
and we are failing when using AVRO when OIDC is enabled,
External Client (OIDC) -> Karapace-Rest (OIDC) -> Karapace-Schema
```
curl -k \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/vnd.kafka.avro.v2+json" \
-X POST "https://${REST_HOST}/topics/$TOPIC" \
-d '{
"value_schema": "{\"type\": \"record\", \"name\": \"simple\", \"fields\": [{\"name\": \"name\", \"type\": \"string\"}]}",
"records": [
{
"value": {
"name": "'"$RANDOM"'"
}
}
]
}'
echo -e "\n"
```
External Client Terminal Log Error:
```
{"error_code":40801,"message":"Error when registering schema.format = AVRO, subject = -value"}
```
KarapaceRest Server log Error:
```
aiohttp.access MainThread INFO 0.011162s - "POST /topics/ HTTP/1.1" 408 "curl/7.76.1" response=401b request_body=225b
```
# What did you expect to happen?
When both OIDC and basicAuth are enabled at the same time within schema-registry,
External Client (OIDC) -> Schema-Registry
```
TOKEN=$(curl -k -X POST "$TOKEN_URL" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password" \
-d "client_id=schema-registry" \
-d "username=" \
-d "password=" \
| jq -r .access_token)
curl -vk -H "Authorization: Bearer $TOKEN" "https://${SCHEMA_REG_HOST}/subjects"
```
External Client (basicAuth) -> Schema-Registry
```
curl -vk -u ":" "https://${SCHEMA_REG_HOST}/subjects"
```
External Client (OIDC) -> SchemaRest -> Schema-Registry (OIDC or basicAuth)
```
curl -k \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/vnd.kafka.avro.v2+json" \
-X POST "https://${REST_HOST}/topics/$TOPIC" \
-d '{
"value_schema": "{\"type\": \"record\", \"name\": \"simple\", \"fields\": [{\"name\": \"name\", \"type\": \"string\"}]}",
"records": [
{
"value": {
"name": "'"$RANDOM"'"
}
}
]
}'
echo -e "\n"
```
# What else do we need to know?
Are there any workarounds you can recommend?
Contributor guide
Assessment
This issue has not been assessed yet.