Correct the SchemaRegistry authentication for SASL_INHERIT #733
Conversation
…ng to the docs. Docs: https://kafka.apache.org/0100/documentation.html#producerconfigs This will fix the SASL_INHERIT in SchemaRegistry. Still the key/secret (sasl.username/sasl.password) are normally different between Cluster and Schema-Registry.
…try." This reverts commit 3c3ebe0
|
It looks like @abij hasn't signed our Contributor License Agreement, yet.
You can read and sign our full Contributor License Agreement here. Once you've signed reply with Appreciation of efforts, clabot |
|
[clabot:check] |
|
@confluentinc It looks like @abij just signed our Contributor License Agreement. 👍 Always at your service, clabot |
| @@ -135,8 +135,8 @@ def _configure_basic_auth(conf): | |||
| raise ValueError("schema.registry.basic.auth.credentials.source must be one of {}" | |||
| .format(VALID_AUTH_PROVIDERS)) | |||
| if auth_provider == 'SASL_INHERIT': | |||
| if conf.pop('sasl.mechanism', '').upper() is ['GSSAPI']: | |||
| raise ValueError("SASL_INHERIT does not support SASL mechanisms GSSAPI") | |||
| if conf.pop('sasl.mechanism', '').upper() == 'GSSAPI': | |||
|
I did add the plural fallback for mechanism(s), if you have a suggestion for the deprecation warning I could include this in the PR as-well. |
|
In retrospect deprecation since they are one and the same for the underlying producer/consumer clients. Can you add a quick test to |
|
@abij are you planning on still pursuing getting this PR merged? I recently hit this issue and would like to help however possible. thanks! |
|
Added a testcase to cover these lines as suggested by @rnpridgeon. |
|
Thank you for your contribution! |
We ran into an issue connecting the SchemaRegistry inside the Producer.
I looked into the problem, it turns out the Server(broker) can use multiple
sasl.mechanisms(plural) and the clients (producer / consumer)sasl.mechanism(singular). There was an issue passing through this config, when the settingschema.registry.basic.auth.credentials.sourceis set toSASL_INHERIT.I think there is no point in inheriting the credentials, since the SchemaRegistry has separate key/secret, but maybe there is a way to use the same credentials for both (SR + Cluster).
This PR will fix the SASL_INHERIT in SchemaRegistry.
I did add an example for
confluent_cloud.py, but looks like theavro-cli.pyhas a working solution already, so I reverted this commit.