Aiven-Open / Aiven-Open/karapace
OIDC Karapace-REST - Consumer instance subscriber "not exists" after new access-token
- 主要語言
- Python
- 星號
- 634
- 分支
- 110
- 平均合併
- 4 天 7 小時
- 30 天內合併 PR
- 4
描述
# What happened?
We have an OIDC implementation of Karapace REST with Kafka instance and Keycloak as IDAM service.
Getting the access-token from Keycloak for the client user and creating a consumer instance subscriber with the token through Karapace REST and then getting a new access-token for the same client user results in consumer instance subscriber being removed and not found.
# What did you expect to happen?
When client user has to renew the access-token, it was expected that any previously created consumer instance subscriber to still exist even with the new token. The client should not be expected to create the same consumer instance subscriber every time a new access-token.
# What else do we need to know?
We run OpenShift with Karapace 5.0.3. We do plan to update to Karapace 6.2.X shortly but the code that handles OIDC access-token seems the same between the two versions.
In the Karapace code, the access-token in `auth_header` seems to be getting used as a key for a data structure resulting in eviction of consumer instance every time a new access-token is given for the same client user.
貢獻指南
研究方向
Start by tracing the Karapace REST consumer-instance subscriber lifecycle and the data structure keyed by auth_header during token renewal. Reproduce the sequence with Keycloak: create a subscriber with one access-token, obtain a new token for the same client user, and verify whether the subscriber remains available. Done means token renewal no longer removes or hides the existing subscriber; no file or test is named in the issue.
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- kafka, python
- 領域
- api, authentication, backend
- Issue 類型
- 缺陷
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 冷清
- 描述清晰度
- 基本清楚
- 新手友好度
- 52/100