Skip to content

scram support fails - #1

Merged
bubunyo merged 4 commits into
mainfrom
feat/support-scram
May 11, 2026
Merged

scram support fails#1
bubunyo merged 4 commits into
mainfrom
feat/support-scram

Conversation

@bubunyo

@bubunyo bubunyo commented May 11, 2026

Copy link
Copy Markdown
Owner

No description provided.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR extends kroxy’s SASL pass-through model to support SCRAM-SHA-256 and SCRAM-SHA-512 in addition to PLAIN, enabling tenant routing based on the SCRAM client-first username while relaying SaslAuthenticate payloads to the upstream broker.

Changes:

  • Refactors upstream connection setup to separate ApiVersions / SaslHandshake negotiation from mechanism-specific authentication, adding a SCRAM relay path.
  • Adds proxy-side SCRAM handling: mechanism negotiation, username extraction from client-first-message for tenant routing, and SaslAuthenticate relay to upstream.
  • Updates docs, metrics, and tests (unit + integration) to cover SCRAM mechanisms.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
upstream/conn.go Splits dialing/negotiation vs auth; adds DialForSCRAM + SaslAuthenticate relay helper.
proxy/conn.go Adds SCRAM state handling and SaslAuthenticate relay flow; introduces SASL handshake/auth outcome metric.
auth/sasl_scram.go Adds SCRAM mechanism constants and parsing of SCRAM client-first-message username.
observability/metrics.go Adds a new Prometheus counter for SASL handshake/auth outcomes.
README.md Documents SCRAM support and updated authentication model/limitations.
proxy/upstream_test.go Extends fake broker to support multi-round SCRAM-style SaslAuthenticate replies.
proxy/conn_scram_test.go Adds unit tests for SCRAM handshake advertisement and relay behavior.
integration/scram_test.go Adds end-to-end SCRAM-SHA-256 / SCRAM-SHA-512 integration coverage.
integration/kafka_test.go Updates Kafka container startup to enable SCRAM and provision SCRAM credentials.
dockerfiles/kafka_jaas.conf Adds SCRAM login module to demo JAAS config.
dockerfiles/docker-compose.yml Advertises SCRAM mechanisms and documents how to bootstrap SCRAM users in the demo stack.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread proxy/conn_scram_test.go
Comment thread upstream/conn.go Outdated
Comment thread proxy/conn.go

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

Comment thread auth/sasl_scram.go
Comment thread observability/metrics.go
Comment thread integration/kafka_test.go
@bubunyo
bubunyo merged commit 349ceaf into main May 11, 2026
12 checks passed
@bubunyo
bubunyo deleted the feat/support-scram branch June 29, 2026 15:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants