Aiven-Open / Aiven-Open/karapace

OIDC Karapace-REST - Consumer instance subscriber "not exists" after new access-token

未關閉
#1,330 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
634
分支
110
平均合併
4 天 7 小時
30 天內合併 PR
4

描述

# What happened?

We have an OIDC implementation of Karapace REST with Kafka instance and Keycloak as IDAM service.

Getting the access-token from Keycloak for the client user and creating a consumer instance subscriber with the token through Karapace REST and then getting a new access-token for the same client user results in consumer instance subscriber being removed and not found.

# What did you expect to happen?

When client user has to renew the access-token, it was expected that any previously created consumer instance subscriber to still exist even with the new token. The client should not be expected to create the same consumer instance subscriber every time a new access-token.

# What else do we need to know?

We run OpenShift with Karapace 5.0.3. We do plan to update to Karapace 6.2.X shortly but the code that handles OIDC access-token seems the same between the two versions.

In the Karapace code, the access-token in `auth_header` seems to be getting used as a key for a data structure resulting in eviction of consumer instance every time a new access-token is given for the same client user.

貢獻指南

開啟貢獻指南

研究方向

Start by tracing the Karapace REST consumer-instance subscriber lifecycle and the data structure keyed by auth_header during token renewal. Reproduce the sequence with Keycloak: create a subscriber with one access-token, obtain a new token for the same client user, and verify whether the subscriber remains available. Done means token renewal no longer removes or hides the existing subscriber; no file or test is named in the issue.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
kafka, python
領域
api, authentication, backend
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
冷清
描述清晰度
基本清楚
新手友好度
52/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。