amaechler commented on code in PR #20471:
URL: https://github.com/apache/druid/pull/20471#discussion_r4167483442
##########
extensions-core/kafka-indexing-service/pom.xml:
##########
@@ -67,6 +67,18 @@
</exclusion>
</exclusions>
</dependency>
+ <!-- Provides the AWS_MSK_IAM SASL mechanism; its AWS SDK comes from
druid-aws-common, so no transitives ship. -->
+ <dependency>
+ <groupId>software.amazon.msk</groupId>
+ <artifactId>aws-msk-iam-auth</artifactId>
+ <scope>runtime</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>*</groupId>
Review Comment:
Thanks, this is deliberate. The gap is not specific to this PR. Druid's own
chain (`AWSCredentialsUtils.defaultAWSCredentialsProviderChain`, used by S3 and
Kinesis) fails on the same `sso-session` profile with the same "the 'sso'
service module must be on the class path" error, because `lib/` lacks these
modules.
I had Claude look up some specifics around how AWS SSO works:
> SDK SSO profiles (`sso_session`, `sso_start_url`) use a token from a
user's IAM Identity Center sign-in, and `ssooidc` only refreshes that user
token. Workloads use other sources: web identity federation (OIDC token via STS
`AssumeRoleWithWebIdentity`, as with IRSA), `credential_process` (for example
IAM Roles Anywhere), instance profiles, pod identity and task roles. I verified
that web identity and `credential_process` resolve with the shipped `lib/`. No
issue has asked for SSO support, so I left these modules out.
>
> Keeping the plugin's transitives in the Kafka extensions would not fix it.
`ProfileCredentialsUtils` in `lib/` loads
`SsoProfileCredentialsProviderFactory` by name from the thread context
classloader or its own. Credentials resolve during the SASL handshake on the
polling thread, outside the context-classloader switch around consumer
construction, so an extension copy is never found. In a reproduction with an
extension classloader over the shipped `lib/`, it worked only when the context
classloader was the extension's.
That said, users who need SSO can add `sso`, `ssooidc` and
`aws-json-protocol` to `lib/` in their own Druid install. `sso` needs
`aws-json-protocol`; without it, resolution fails with `NoClassDefFoundError`.
I verified this layout for both the plugin and Druid's chain. We could always
add them to `druid-aws-common` if there is demand (in a separate PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
