liaoxin01 commented on PR #69391: URL: https://github.com/apache/doris/pull/69391#issuecomment-6632822387
Two compatibility concerns: 1. **[High] Preserve Kerberos login and renewal.** Rejecting `sasl.kerberos.keytab` and forcing `sasl.kerberos.min.time.before.relogin=0` breaks the [documented Kerberos configuration](https://doris.apache.org/docs/dev/data-operate/import/import-way/routine-load-manual/#import-kafka-data-with-kerberos-authentication), including existing jobs after upgrade. Requiring external ticket management is not equivalent to preserving automatic login/renewal. Please provide a safe replacement and validate restart, ticket expiry, and reconnect. 2. **[High] Preserve OIDC JWT bearer authentication.** The allowlist omits `sasl.oauthbearer.grant.type`, `sasl.oauthbearer.assertion.private.key.pem`, and assertion claim properties supported by the bundled [librdkafka 2.16](https://github.com/confluentinc/librdkafka/blob/v2.16.0/CONFIGURATION.md). Previously valid JWT bearer jobs now fail creation or runtime validation after upgrade. Please admit the safe scalar properties and cover creation, recovery, and token refresh. This is separate from the already-fixed client credential aliases. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
