-
Notifications
You must be signed in to change notification settings - Fork 39
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
enrich-kafka: authenticate with Event Hubs using OAuth2 (close #863)
- Loading branch information
Showing
8 changed files
with
196 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
103 changes: 103 additions & 0 deletions
103
...cala/com.snowplowanalytics.snowplow.enrich.kafka/AzureAuthenticationCallbackHandler.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| /* | ||
| * Copyright (c) 2023-present Snowplow Analytics Ltd. | ||
| * All rights reserved. | ||
| * | ||
| * This software is made available by Snowplow Analytics, Ltd., | ||
| * under the terms of the Snowplow Limited Use License Agreement, Version 1.0 | ||
| * located at https://docs.snowplow.io/limited-use-license-1.0 | ||
| * BY INSTALLING, DOWNLOADING, ACCESSING, USING OR DISTRIBUTING ANY PORTION | ||
| * OF THE SOFTWARE, YOU AGREE TO THE TERMS OF SUCH LICENSE AGREEMENT. | ||
| */ | ||
| package com.snowplowanalytics.snowplow.enrich.kafka | ||
|
|
||
| import java.net.URI | ||
| import java.{lang, util} | ||
|
|
||
| import com.nimbusds.jwt.JWTParser | ||
|
|
||
| import javax.security.auth.callback.Callback | ||
| import javax.security.auth.callback.UnsupportedCallbackException | ||
| import javax.security.auth.login.AppConfigurationEntry | ||
|
|
||
| import org.apache.kafka.clients.CommonClientConfigs | ||
| import org.apache.kafka.common.security.auth.AuthenticateCallbackHandler | ||
| import org.apache.kafka.common.security.oauthbearer.OAuthBearerToken | ||
| import org.apache.kafka.common.security.oauthbearer.OAuthBearerTokenCallback | ||
|
|
||
| import com.azure.identity.DefaultAzureCredentialBuilder | ||
| import com.azure.core.credential.TokenRequestContext | ||
|
|
||
| // We need separate instances of callback handler with separate source and | ||
| // sinks because they need different tokens to authenticate. However we are | ||
| // only giving class name to Kafka and it initializes the class itself and if | ||
| // we pass same class name for all source and sinks, Kafka initializes and uses | ||
| // only one instance of the callback handler. To create separate instances, we | ||
| // created multiple different classes and pass their names to respective sink | ||
| // and source properties. With this way, all the source and sinks will have their | ||
| // own callback handler instance. | ||
|
|
||
| class SourceAuthHandler extends AzureAuthenticationCallbackHandler | ||
|
|
||
| class GoodSinkAuthHandler extends AzureAuthenticationCallbackHandler | ||
|
|
||
| class BadSinkAuthHandler extends AzureAuthenticationCallbackHandler | ||
|
|
||
| class PiiSinkAuthHandler extends AzureAuthenticationCallbackHandler | ||
|
|
||
| class AzureAuthenticationCallbackHandler extends AuthenticateCallbackHandler { | ||
|
|
||
| val credentials = new DefaultAzureCredentialBuilder().build() | ||
|
|
||
| var sbUri: String = "" | ||
|
|
||
| override def configure( | ||
| configs: util.Map[String, _], | ||
| saslMechanism: String, | ||
| jaasConfigEntries: util.List[AppConfigurationEntry] | ||
| ): Unit = { | ||
| val bootstrapServer = | ||
| configs | ||
| .get(CommonClientConfigs.BOOTSTRAP_SERVERS_CONFIG) | ||
| .toString | ||
| .replaceAll("\\[|\\]", "") | ||
| .split(",") | ||
| .toList | ||
| .headOption match { | ||
| case Some(s) => s | ||
| case None => throw new Exception("Empty bootstrap servers list") | ||
| } | ||
| val uri = URI.create("https://" + bootstrapServer) | ||
| // Workload identity works with '.default' scope | ||
| this.sbUri = s"${uri.getScheme}://${uri.getHost}/.default" | ||
| } | ||
|
|
||
| override def handle(callbacks: Array[Callback]): Unit = | ||
| callbacks.foreach { | ||
| case callback: OAuthBearerTokenCallback => | ||
| val token = getOAuthBearerToken() | ||
| callback.token(token) | ||
| case callback => throw new UnsupportedCallbackException(callback) | ||
| } | ||
|
|
||
| def getOAuthBearerToken(): OAuthBearerToken = { | ||
| val reqContext = new TokenRequestContext() | ||
| reqContext.addScopes(sbUri) | ||
| val accessToken = credentials.getTokenSync(reqContext).getToken | ||
| val jwt = JWTParser.parse(accessToken) | ||
| val claims = jwt.getJWTClaimsSet | ||
|
|
||
| new OAuthBearerToken { | ||
| override def value(): String = accessToken | ||
|
|
||
| override def lifetimeMs(): Long = claims.getExpirationTime.getTime | ||
|
|
||
| override def scope(): util.Set[String] = null | ||
|
|
||
| override def principalName(): String = null | ||
|
|
||
| override def startTimeMs(): lang.Long = null | ||
| } | ||
| } | ||
|
|
||
| override def close(): Unit = () | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters