Class OAuthBearerExtensionsValidatorCallback
java.lang.Object
org.apache.kafka.common.security.oauthbearer.OAuthBearerExtensionsValidatorCallback
- All Implemented Interfaces:
Callback
A
Callback
for use by the SaslServer
implementation when it
needs to validate the SASL extensions for the OAUTHBEARER mechanism
Callback handlers should use the valid(String)
method to communicate valid extensions back to the SASL server.
Callback handlers should use the
error(String, String)
method to communicate validation errors back to
the SASL Server.
As per RFC-7628 (https://tools.ietf.org/html/rfc7628#section-3.1), unknown extensions must be ignored by the server.
The callback handler implementation should simply ignore unknown extensions,
not calling error(String, String)
nor valid(String)
.
Callback handlers should communicate other problems by raising an IOException
.
The OAuth bearer token is provided in the callback for better context in extension validation.
It is very important that token validation is done in its own OAuthBearerValidatorCallback
irregardless of provided extensions, as they are inherently insecure.
-
Constructor Summary
ConstructorDescriptionOAuthBearerExtensionsValidatorCallback
(OAuthBearerToken token, SaslExtensions extensions) -
Method Summary
Modifier and TypeMethodDescriptionvoid
Set the error value for a specific extension key-value pair if validation has failedtoken()
void
Validates a specific extension in the originalinputExtensions
map
-
Constructor Details
-
OAuthBearerExtensionsValidatorCallback
-
-
Method Details
-
token
- Returns:
OAuthBearerToken
the OAuth bearer token of the client
-
inputExtensions
- Returns:
SaslExtensions
consisting of the unvalidated extension names and values that were sent by the client
-
validatedExtensions
- Returns:
- an unmodifiable
Map
consisting of the validated and recognized by the server extension names and values
-
invalidExtensions
- Returns:
- An immutable
Map
consisting of the name->error messages of extensions which failed validation
-
ignoredExtensions
- Returns:
- An immutable
Map
consisting of the extensions that have neither been validated nor invalidated
-
valid
Validates a specific extension in the originalinputExtensions
map- Parameters:
extensionName
- - the name of the extension which was validated
-
error
Set the error value for a specific extension key-value pair if validation has failed- Parameters:
invalidExtensionName
- the mandatory extension name which caused the validation failureerrorMessage
- error message describing why the validation failed
-