Skip to content

Add a SaslTermination filter #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tombentley merged 52 commits into from
Aug 3, 2026
Merged

Add a SaslTermination filter #124

Changes from all commits
Commits
Show all changes
52 commits
Select commit Hold shift + click to select a range
6c7e4b0
docs(proposal): add SASL termination design proposal
tombentley Jul 19, 2026
d9f34f9
docs(proposal): add KIP-368 reauthentication to SASL termination prop…
tombentley Jul 20, 2026
49aede4
docs(proposal): document timing side-channel mitigation
tombentley Jul 20, 2026
0df6a4a
docs(proposal): document keystore file permission enforcement
tombentley Jul 20, 2026
05d5823
docs(proposal): document Kafka internal API dependencies
tombentley Jul 20, 2026
0e086f4
docs(proposal): reference Proposal 116 for Kafka internal API depende…
tombentley Jul 20, 2026
f93c08e
docs(proposal): rename connectionsMaxReauth to maxTimeBeforeReauth
tombentley Jul 20, 2026
b15988d
docs(proposal): require audience/issuer and document OAUTHBEARER know…
tombentley Jul 20, 2026
fef813e
docs(proposal): restructure proposal into per-component documentation
tombentley Jul 20, 2026
14ca471
docs(proposal): clarify heap exposure as accepted risk, not mitigated
tombentley Jul 20, 2026
d3fe03d
docs(proposal): clarify PBKDF2 iteration count rationale
tombentley Jul 20, 2026
a22b862
docs(proposal): document CLI tool interface in man-page style
tombentley Jul 20, 2026
c5f300f
docs(proposal): document CLI tool file permission security measures
tombentley Jul 20, 2026
d34999e
Rename proposal to use PR number 124
tombentley Jul 21, 2026
25ae280
docs(proposal): explain why mechanisms belong in a single filter
tombentley Jul 21, 2026
6d76459
docs(proposal): replace ASCII state diagram with transition table
tombentley Jul 21, 2026
e2efa79
docs(proposal): rename Event column to Triggering event for clarity
tombentley Jul 21, 2026
078e71b
docs(proposal): document per-mechanism reauthentication behaviour
tombentley Jul 21, 2026
76a8cd2
docs(proposal): add GSSAPI (Kerberos) to rejected alternatives
tombentley Jul 21, 2026
e3a4bbb
docs(proposal): add component overview diagram
tombentley Jul 24, 2026
a1a7edb
docs(proposal): address review feedback on SASL termination proposal
tombentley Jul 27, 2026
c159e17
docs(proposal): replace monolithic diagram with focused views
tombentley Jul 27, 2026
aef3f22
docs(proposal): fix state diagram rendering
tombentley Jul 27, 2026
0973fba
docs(proposal): add delegation tokens as out of scope
tombentley Jul 30, 2026
337e697
docs(proposal): acknowledge SCRAM credential isolation trade-offs
tombentley Jul 30, 2026
5534b83
docs(proposal): remove SCRAM credential APIs from API_VERSIONS
tombentley Jul 30, 2026
29aef91
docs(proposal): distinguish Alter vs Describe SCRAM credential APIs
tombentley Jul 30, 2026
d19a2ae
docs(proposal): acknowledge upstream auth failure visibility gap
tombentley Jul 30, 2026
4ee66d6
docs(proposal): move upstream auth failure to open questions
tombentley Jul 30, 2026
b09d8d0
docs(proposal): clarify filter intercepts all requests
tombentley Jul 30, 2026
fd616ee
docs(proposal): fail closed on unknown SASL request versions
tombentley Jul 30, 2026
496041a
docs(proposal): add configurable SaslSubjectBuilderService
tombentley Jul 30, 2026
693e3da
docs(proposal): change mechanisms from map to list with type discrimi…
tombentley Jul 30, 2026
5a67abc
docs(proposal): use per-variant SCRAM config subclasses
tombentley Jul 30, 2026
fc3c7ed
docs(proposal): add shouldHandleRequest optimization
tombentley Jul 30, 2026
29f29bf
docs(proposal): confirm Kafka SaslServer impls are GC-safe
tombentley Jul 30, 2026
fa9f0f0
docs(proposal): note TokenValidator SPI as planned future work
tombentley Jul 30, 2026
40deb2c
docs(proposal): reject __cluster_metadata credential store
tombentley Jul 30, 2026
ba1b432
docs(proposal): hash usernames for KeyStore aliases
tombentley Jul 30, 2026
75619be
docs(proposal): use hex encoding for KeyStore alias hash
tombentley Jul 30, 2026
e4ab1ab
docs(proposal): add version field to credential JSON format
tombentley Jul 30, 2026
2f746a5
docs(proposal): add trust boundary framing to security model
tombentley Jul 30, 2026
16eafaf
docs(proposal): note filter composition validation is out of scope
tombentley Jul 30, 2026
60911bb
Fix link;
tombentley Jul 30, 2026
7df521d
docs(proposal): internalize mechanism handling, add unsupported mecha…
tombentley Jul 30, 2026
3d56a13
docs(proposal): add explicit security posture statement
tombentley Aug 3, 2026
bfb393a
docs(proposal): add OAUTHBEARER error message leakage threat
tombentley Aug 3, 2026
63450f1
docs(proposal): document OAUTHBEARER system property dependency
tombentley Aug 3, 2026
5311139
docs(proposal): make PBKDF2 iteration count configurable
tombentley Aug 3, 2026
1a38244
docs(proposal): add offline brute-force threat to credential store
tombentley Aug 3, 2026
b6ca860
docs(proposal): clarify fixedAuthDelay as floor, add SCRAM non-fail-fast
tombentley Aug 3, 2026
7725263
docs(proposal): add input size limits for authBytes and username
tombentley Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Loading