MdTanwer opened a new pull request, #23281: URL: https://github.com/apache/kafka/pull/23281
This change is my original work and I license it to the Apache Kafka project under the Apache License 2.0. ## Summary - `sasl.login.callback.handler.class` was used for the initial Kerberos login but ignored when the TGT was refreshed. `KerberosLogin.reLogin()` constructed a new `LoginContext` with a null callback, so password-based Kerberos clients failed after ticket expiry. - Re-login now reuses the configured `AuthenticateCallbackHandler`, matching the initial login path. - Adds a unit test that plants a fake TGT and requires a `PasswordCallback`, asserting the handler is invoked again on re-login. Fixes [KAFKA-18744](https://issues.apache.org/jira/browse/KAFKA-18744). Revives the approach from #18589 with the unit test requested in review. ## Test plan - [x] `./gradlew clients:test --tests org.apache.kafka.common.security.kerberos.KerberosLoginTest` - [x] `./gradlew clients:checkstyleMain clients:checkstyleTest` - [ ] Confirm password-based GSSAPI still authenticates after TGT refresh with a short `ticket_lifetime` (the original reporter's scenario) Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
