-
Notifications
You must be signed in to change notification settings - Fork 69
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Feature: SASL Auth (PLAIN and SCRAM) (#3)
* Test and fix issues with SASL plain and scram authentication * Return error on SASL SCRAM failure * Reformat JS code * Fix docstrings/comments in scripts * Remove minBytes and maxBytes from reader * Fix linter errors * Add a slightly better implementation of credentials for SASL * Update README --- For testing this feature, I've created a test environment with SASL PLAIN and SASL SCRAM enabled using Confluents test environments: <https://github.com/vdesabou/kafka-docker-playground/tree/master/environment/sasl-plain> <https://github.com/vdesabou/kafka-docker-playground/tree/master/environment/sasl-scram> ``` $ git clone https://github.com/vdesabou/kafka-docker-playground $ cd kafka-docker-playground/environment/sasl-plain $ ./start.sh ``` I've compiled xk6-kafka and copied it to the broker container. I also copied the test_sasl_auth.js into the container. Then I executed a shell inside the container and run k6 using the test script. ``` $ xk6 build --with github.com/mostafa/xk6-kafka=. $ docker cp k6 broker:/ $ docker cp test_sasl_auth.js broker:/ $ docker exec -it broker bash [appuser@broker ~]$ cd / [appuser@broker ~]$ ./k6 run --vus 50 --duration 60s test_sasl_auth.js /\ |‾‾| /‾‾/ /‾‾/ /\ / \ | |/ / / / / \/ \ | ( / ‾‾\ / \ | |\ \ | (‾) | / __________ \ |__| \__\ \_____/ .io execution: local script: test_sasl_auth.js output: - scenarios: (100.00%) 1 scenario, 50 max VUs, 1m30s max duration (incl. graceful stop): * default: 50 looping VUs for 1m0s (gracefulStop: 30s) running (1m00.4s), 00/50 VUs, 3711 complete and 0 interrupted iterations default ✓ [======================================] 50 VUs 1m0s ✓ is sent ✓ 10 messages returned █ teardown checks.........................: 100.00% ✓ 374811 ✗ 0 data_received..................: 0 B 0 B/s data_sent......................: 0 B 0 B/s iteration_duration.............: avg=811.56ms min=7.13ms med=734.71ms max=2.34s p(90)=1.1s p(95)=1.34s iterations.....................: 3711 61.420675/s kafka.reader.dial.count........: 50 0.827549/s kafka.reader.error.count.......: 0 0/s kafka.reader.fetches.count.....: 50 0.827549/s kafka.reader.message.bytes.....: 7.3 MB 120 kB/s kafka.reader.message.count.....: 37160 615.034296/s kafka.reader.rebalance.count...: 0 0/s kafka.reader.timeouts.count....: 0 0/s kafka.writer.dial.count........: 50 0.827549/s kafka.writer.error.count.......: 0 0/s kafka.writer.message.bytes.....: 146 MB 2.4 MB/s kafka.writer.message.count.....: 742200 12284.134941/s kafka.writer.rebalance.count...: 250 4.137744/s kafka.writer.write.count.......: 742200 12284.134941/s vus............................: 50 min=50 max=50 vus_max........................: 50 min=50 max=50 ```
- Loading branch information
Showing
7 changed files
with
257 additions
and
85 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
package kafka | ||
|
||
import ( | ||
"encoding/json" | ||
"time" | ||
|
||
kafkago "github.com/segmentio/kafka-go" | ||
"github.com/segmentio/kafka-go/sasl/plain" | ||
"github.com/segmentio/kafka-go/sasl/scram" | ||
) | ||
|
||
const ( | ||
Plain = "plain" | ||
SHA256 = "sha256" | ||
SHA512 = "sha512" | ||
) | ||
|
||
type Credentials struct { | ||
Username string `json:"username"` | ||
Password string `json:"password"` | ||
Algorithm string `json:"algorithm"` | ||
} | ||
|
||
func unmarshalCredentials(auth string) (creds *Credentials, err error) { | ||
creds = &Credentials{ | ||
Algorithm: Plain, | ||
} | ||
|
||
err = json.Unmarshal([]byte(auth), &creds) | ||
|
||
return | ||
} | ||
|
||
func getDialer(creds *Credentials) (dialer *kafkago.Dialer) { | ||
dialer = &kafkago.Dialer{ | ||
Timeout: 10 * time.Second, | ||
DualStack: true, | ||
} | ||
|
||
if creds.Algorithm == Plain { | ||
mechanism := plain.Mechanism{ | ||
Username: creds.Username, | ||
Password: creds.Password, | ||
} | ||
dialer.SASLMechanism = mechanism | ||
return | ||
} else { | ||
hashes := make(map[string]scram.Algorithm) | ||
hashes["sha256"] = scram.SHA256 | ||
hashes["sha512"] = scram.SHA512 | ||
|
||
mechanism, err := scram.Mechanism( | ||
hashes[creds.Algorithm], | ||
creds.Username, | ||
creds.Password, | ||
) | ||
if err != nil { | ||
ReportError(err, "authentication failed") | ||
return nil | ||
} | ||
dialer.SASLMechanism = mechanism | ||
return | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.