MdTanwer opened a new pull request, #23281:
URL: https://github.com/apache/kafka/pull/23281

   This change is my original work and I license it to the Apache Kafka project 
under the Apache License 2.0.
   
   ## Summary
   - `sasl.login.callback.handler.class` was used for the initial Kerberos 
login but ignored when the TGT was refreshed. `KerberosLogin.reLogin()` 
constructed a new `LoginContext` with a null callback, so password-based 
Kerberos clients failed after ticket expiry.
   - Re-login now reuses the configured `AuthenticateCallbackHandler`, matching 
the initial login path.
   - Adds a unit test that plants a fake TGT and requires a `PasswordCallback`, 
asserting the handler is invoked again on re-login.
   
   Fixes [KAFKA-18744](https://issues.apache.org/jira/browse/KAFKA-18744). 
Revives the approach from #18589 with the unit test requested in review.
   
   ## Test plan
   - [x] `./gradlew clients:test --tests 
org.apache.kafka.common.security.kerberos.KerberosLoginTest`
   - [x] `./gradlew clients:checkstyleMain clients:checkstyleTest`
   - [ ] Confirm password-based GSSAPI still authenticates after TGT refresh 
with a short `ticket_lifetime` (the original reporter's scenario)
   
   
   Made with [Cursor](https://cursor.com)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to