Aiven-Open / Aiven-Open/karapace

OIDC Karapace-REST - Consumer instance subscriber "not exists" after new access-token

Aperta
#1,330 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
634
Fork
110
Merge medio
4g 7h
PR unite (30g)
4

Descrizione

# What happened?

We have an OIDC implementation of Karapace REST with Kafka instance and Keycloak as IDAM service.

Getting the access-token from Keycloak for the client user and creating a consumer instance subscriber with the token through Karapace REST and then getting a new access-token for the same client user results in consumer instance subscriber being removed and not found.

# What did you expect to happen?

When client user has to renew the access-token, it was expected that any previously created consumer instance subscriber to still exist even with the new token. The client should not be expected to create the same consumer instance subscriber every time a new access-token.

# What else do we need to know?

We run OpenShift with Karapace 5.0.3. We do plan to update to Karapace 6.2.X shortly but the code that handles OIDC access-token seems the same between the two versions.

In the Karapace code, the access-token in `auth_header` seems to be getting used as a key for a data structure resulting in eviction of consumer instance every time a new access-token is given for the same client user.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.