[server] Add retriable authentication exception.

[loserwang1024]

Purpose

Linked issue: close #844

Brief change log

Tests

com.alibaba.fluss.rpc.netty.authenticate.AuthenticationTest#testRetirableAuthenticateException

API and Format

Documentation

[wuchong]

Is the removal of !authenticator.isCompleted() necessary? I though the authenticator.evaluateResponse may change status of authenticator into complete and don't need to send challenge.

[loserwang1024]

For some authentication protocol, the server will be complete before the client becomes complete.

Take SCRAM-SHA-256 of kafka for example,

1. sasl server recieves RECEIVE_CLIENT_FINAL_MESSAGE, and then mark authenticator server status as COMPLETE, then still send serverFinalMessage

// org.apache.kafka.common.security.scram.internals.ScramSaslServer#evaluateResponse
case RECEIVE_CLIENT_FINAL_MESSAGE:
                    try {
                        ClientFinalMessage clientFinalMessage = new ClientFinalMessage(response);
                        verifyClientProof(clientFinalMessage);
                        byte[] serverKey = scramCredential.serverKey();
                        byte[] serverSignature = formatter.serverSignature(serverKey, clientFirstMessage, serverFirstMessage, clientFinalMessage);
                        ServerFinalMessage serverFinalMessage = new ServerFinalMessage(null, serverSignature);
                        clearCredentials();
                        setState(State.COMPLETE);
                        return serverFinalMessage.toBytes();
                    } catch (InvalidKeyException e) {
                        throw new SaslException("Authentication failed: Invalid client final message", e);
                    }

2. Then sasl client recieve this RECEIVE_SERVER_FINAL_MESSAGE, then will set status and State.COMPLETE and then return null(no longer send anymore)

org.apache.kafka.common.security.scram.internals.ScramSaslClient#evaluateChallenge

 case RECEIVE_SERVER_FINAL_MESSAGE:
                    ServerFinalMessage serverFinalMessage = new ServerFinalMessage(challenge);
                    if (serverFinalMessage.error() != null)
                        throw new SaslException("Sasl authentication using " + mechanism + " failed with error: " + serverFinalMessage.error());
                    handleServerFinalMessage(serverFinalMessage.serverSignature());
                    setState(State.COMPLETE);
                    return null;

I add same logic in com.alibaba.fluss.rpc.netty.authenticate.MutualAuthenticationPlugin.

[loserwang1024]

Rebase this pr with three modification:

1. Add ExponentialBackoff to calculate the backoff time.
2. Retain authentication logic in ServerConnection.
3. Add initialize method for ServerAuthenticator and ClientAuthenticator to reset the status of authenticator.

[luoyuxia]

Maybe we can verify this pr in our env before merge that to avoid go back and forth. Maybe in this afternoon or tomorrow to verify this pr.

[loserwang1024]

Maybe we can verify this pr in our env before merge that to avoid go back and forth. Maybe in this afternoon or tomorrow to verify this pr.

ok, I will apply the modification of this pr to env test.

[wuchong]

@loserwang1024 please ping me when you have verified in internal env.

[wuchong]

It is passed in our internal env.