Skip to content

KAFKA-17014: ScramFormatter should not use String for password #19082

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 12 commits into from
Closed

KAFKA-17014: ScramFormatter should not use String for password #19082

wants to merge 12 commits into from

Conversation

mingdaoy
Copy link
Contributor

@mingdaoy mingdaoy commented Mar 3, 2025 •
edited
Loading

https://issues.apache.org/jira/browse/KAFKA-17014

Update saltedPassword, generateCredential, and normalize to use char[] for password handling

Gradle Test Run :clients:test > Gradle Test Executor 3 > ScramFormatterTest > rfc7677Example() PASSED
Gradle Test Run :clients:test > Gradle Test Executor 3 > ScramFormatterTest > saslName() PASSED

image

ScramParserTest:
image

@github-actions github-actions bot added triage PRs from the community core Kafka Broker kraft clients small Small PRs labels Mar 3, 2025
szetszwo
szetszwo reviewed Mar 5, 2025
View reviewed changes
Copy link

@szetszwo szetszwo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mingdaoy , thanks a lot for working on this! The change looks good. Just have a few questions/suggestions.

BTW, I am not a Kafka committer. We need to find a Kafka committer reviewing this.

clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java Outdated
@@ -190,7 +190,7 @@ private void setState(State state) {

private ClientFinalMessage handleServerFirstMessage(char[] password) throws SaslException {
try {
byte[] passwordBytes = ScramFormatter.normalize(new String(password));
byte[] passwordBytes = ScramFormatter.normalize(new String(password).toCharArray());
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not simply passing the password as below?

byte[] passwordBytes = ScramFormatter.normalize(password);

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

core/src/main/scala/kafka/server/DelegationTokenManager.scala Outdated
@@ -106,7 +106,7 @@ class DelegationTokenManager(val config: KafkaConfig,
val scramCredentialMap = mutable.Map[String, ScramCredential]()

def scramCredential(mechanism: ScramMechanism): ScramCredential = {
new ScramFormatter(mechanism).generateCredential(hmacString, mechanism.minIterations)
new ScramFormatter(mechanism).generateCredential(hmacString.toCharArray, mechanism.minIterations)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be better if we change hmacString to not using String.

metadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java Outdated
@@ -173,7 +173,9 @@ byte[] saltedPassword(byte[] salt, int iterations) throws Exception {
return configuredSaltedPassword.get();
}
return new ScramFormatter(mechanism).saltedPassword(
configuredPasswordString.get(),
configuredPasswordString
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similarly, it would be better if we change configuredPasswordString to not using String.

mingdaoy
mingdaoy commented Mar 5, 2025
View reviewed changes
metadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java
@@ -173,7 +173,8 @@ byte[] saltedPassword(byte[] salt, int iterations) throws Exception {
return configuredSaltedPassword.get();
}
return new ScramFormatter(mechanism).saltedPassword(
configuredPasswordString.get(),
configuredPassword
Copy link
Contributor Author

@mingdaoy mingdaoy Mar 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@szetszwo Thanks for the review!

ScramParserTest:
image

mingdaoy
mingdaoy commented Mar 5, 2025
View reviewed changes
core/src/main/scala/kafka/server/DelegationTokenManager.scala
val scramCredentialMap = mutable.Map[String, ScramCredential]()

def scramCredential(mechanism: ScramMechanism): ScramCredential = {
new ScramFormatter(mechanism).generateCredential(hmacString, mechanism.minIterations)
new ScramFormatter(mechanism).generateCredential(hmacChars, mechanism.minIterations)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See hmacChars

mingdaoy
mingdaoy commented Mar 5, 2025
View reviewed changes
clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java
@@ -190,7 +190,7 @@ private void setState(State state) {

private ClientFinalMessage handleServerFirstMessage(char[] password) throws SaslException {
try {
byte[] passwordBytes = ScramFormatter.normalize(new String(password));
byte[] passwordBytes = ScramFormatter.normalize(password);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

password

@github-actions github-actions bot removed the triage PRs from the community label Mar 6, 2025
@github-actions GitHub Actions
Copy link

This PR is being marked as stale since it has not had any activity in 90 days. If you
would like to keep this PR alive, please leave a comment asking for a review. If the PR has
merge conflicts, update it with the latest from the base branch.

If you are having difficulty finding a reviewer, please reach out on the [mailing list](https://kafka.apache.org/contact).

If this PR is no longer valid or desired, please feel free to close it. If no activity occurs in the next 30 days, it will be automatically closed.

@github-actions github-actions bot added the stale Stale PRs label Jun 13, 2025
@github-actions GitHub Actions
Copy link

This PR has been closed since it has not had any activity in 120 days. If you feel like this
was a mistake, or you would like to continue working on it, please feel free to re-open the
PR and ask for a review.

@github-actions github-actions bot added the closed-stale PRs that were closed due to inactivity label Jul 13, 2025
@github-actions github-actions bot closed this Jul 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@szetszwo szetszwo szetszwo left review comments

Assignees
No one assigned
Labels
ci-approved clients closed-stale PRs that were closed due to inactivity core Kafka Broker kraft small Small PRs stale Stale PRs
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@mingdaoy @szetszwo @chia7712