Skip to content

[kafka] Add SASL/PLAIN authentication - #4188

Draft
gyang94 wants to merge 3 commits into
apache:mainfrom
gyang94:codex/kafka-pr3-sasl-plain
Draft

[kafka] Add SASL/PLAIN authentication#4188
gyang94 wants to merge 3 commits into
apache:mainfrom
gyang94:codex/kafka-pr3-sasl-plain

Conversation

@gyang94

@gyang94 gyang94 commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Purpose

Linked issue: #4185

Depends on #4187.

This is PR 3 of 4 for the Basic Produce compatibility milestone. The intended review delta is the single tip commit 263282d0d; the earlier stack commits remain visible until their PRs are merged and this branch is rebased.

Brief change log

  • Add Kafka SASL handshake and authentication API handlers.
  • Add per-connection SASL state management.
  • Add SASL/PLAIN server configuration and credential validation.
  • Integrate authentication into the Kafka protocol pipeline.
  • Add handler, configuration, and connection-level tests.

Tests

  • Kafka module: 69 tests passed.
  • Common and RPC portions of the reactor test run passed.
  • Reactor build, Checkstyle, and Spotless validation passed.

API and Format

The change adds internal Kafka authentication plumbing and configuration. It does not change the Fluss public API or storage format.

Documentation

No standalone documentation change in this layer.

Stack

Generative AI disclosure: Codex (GPT-5.6) assisted with implementation and commit organization. Human review is required before merge.

Introduce request dispatch, ApiVersions, metadata discovery, and topic lifecycle operations as the reviewable foundation for subsequent Produce support.

Co-Authored-By: Codex <noreply@openai.com>

AI-Model: gpt-5.6-sol

AI-Contributed/Feature: 2698/2698

AI-Contributed/UT: 1160/1160
Support raw and string Produce requests, validate acks=all semantics, and wake delayed follower fetches after successful appends.

Co-Authored-By: Codex <noreply@openai.com>

AI-Model: gpt-5.6-sol

AI-Contributed/Feature: 1204/1204

AI-Contributed/UT: 2066/2066
Authenticate Kafka protocol connections with SASL/PLAIN and propagate the authenticated principal through request dispatch and authorization.

Co-Authored-By: Codex <noreply@openai.com>

AI-Model: gpt-5.6-sol

AI-Contributed/Feature: 1503/1503

AI-Contributed/UT: 1514/1514
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant