Aiven-Open / Aiven-Open/karapace

When Karapace schema registry has OIDC configured, schema backed requests to Karapace REST fail

Open
#1,274 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
634
Forks
110
Avg merge
4d 7h
Merged PRs (30d)
4

Description

# What happened?

When both OIDC and basicAuth are enabled at the same time within the schema-registry back-end, then all client requests providing basicAuth and OIDC will break.

Ideally we wanted the Schema-Registry to authenticate with the token provided from SchemaRest, but if I'm not mistaken that functionality is currently not supported?

We are successfully sending requests from an external client (OIDC) -> Karapace Rest -> KafkaSASL with JSON
```
curl -k \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/vnd.kafka.json.v2+json" \
-X POST "https://$REST_HOST/topics/$TOPIC" \
-d '{
"records": [
{
"value": {
"age": "'"$RANDOM"'"
}
}
]
}'
```
and we are failing when using AVRO when OIDC is enabled,
External Client (OIDC) -> Karapace-Rest (OIDC) -> Karapace-Schema
```
curl -k \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/vnd.kafka.avro.v2+json" \
-X POST "https://${REST_HOST}/topics/$TOPIC" \
-d '{
"value_schema": "{\"type\": \"record\", \"name\": \"simple\", \"fields\": [{\"name\": \"name\", \"type\": \"string\"}]}",
"records": [
{
"value": {
"name": "'"$RANDOM"'"
}
}
]
}'
echo -e "\n"
```

External Client Terminal Log Error:
```
{"error_code":40801,"message":"Error when registering schema.format = AVRO, subject = -value"}
```

KarapaceRest Server log Error:
```
aiohttp.access MainThread INFO 0.011162s - "POST /topics/ HTTP/1.1" 408 "curl/7.76.1" response=401b request_body=225b
```

# What did you expect to happen?

When both OIDC and basicAuth are enabled at the same time within schema-registry,

External Client (OIDC) -> Schema-Registry
```
TOKEN=$(curl -k -X POST "$TOKEN_URL" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password" \
-d "client_id=schema-registry" \
-d "username=" \
-d "password=" \
| jq -r .access_token)
curl -vk -H "Authorization: Bearer $TOKEN" "https://${SCHEMA_REG_HOST}/subjects"
```

External Client (basicAuth) -> Schema-Registry
```
curl -vk -u ":" "https://${SCHEMA_REG_HOST}/subjects"
```

External Client (OIDC) -> SchemaRest -> Schema-Registry (OIDC or basicAuth)
```
curl -k \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/vnd.kafka.avro.v2+json" \
-X POST "https://${REST_HOST}/topics/$TOPIC" \
-d '{
"value_schema": "{\"type\": \"record\", \"name\": \"simple\", \"fields\": [{\"name\": \"name\", \"type\": \"string\"}]}",
"records": [
{
"value": {
"name": "'"$RANDOM"'"
}
}
]
}'
echo -e "\n"
```

# What else do we need to know?

Are there any workarounds you can recommend?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.