Aiven-Open / Aiven-Open/karapace
OIDC Karapace-REST - Consumer instance subscriber "not exists" after new access-token
- Lingua principale
- Python
- Stelle
- 634
- Fork
- 110
- Merge medio
- 4g 7h
- PR unite (30g)
- 4
Descrizione
# What happened?
We have an OIDC implementation of Karapace REST with Kafka instance and Keycloak as IDAM service.
Getting the access-token from Keycloak for the client user and creating a consumer instance subscriber with the token through Karapace REST and then getting a new access-token for the same client user results in consumer instance subscriber being removed and not found.
# What did you expect to happen?
When client user has to renew the access-token, it was expected that any previously created consumer instance subscriber to still exist even with the new token. The client should not be expected to create the same consumer instance subscriber every time a new access-token.
# What else do we need to know?
We run OpenShift with Karapace 5.0.3. We do plan to update to Karapace 6.2.X shortly but the code that handles OIDC access-token seems the same between the two versions.
In the Karapace code, the access-token in `auth_header` seems to be getting used as a key for a data structure resulting in eviction of consumer instance every time a new access-token is given for the same client user.
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.