Correct the SchemaRegistry authentication for SASL_INHERIT (@abij, confluentinc#733)

Alexander · web-flow · commit 6b6fc684aa4f · 2020-03-17T09:49:55.000+01:00
* Consumers and Producers should use singular: 'sasl.mechanism' according to the docs. Docs: https://kafka.apache.org/0100/documentation.html#producerconfigs This will fix the SASL_INHERIT in SchemaRegistry. Still the key/secret (sasl.username/sasl.password) are normally different between Cluster and Schema-Registry. * Since 'sasl.mechanism' is singular, check it correctly * Update example ccloud with working config for the SchemaRegistry. * Revert "Update example ccloud with working config for the SchemaRegistry." This reverts commit 3c3ebe0 * Do include the correct `sasl.mechanism` config setting. * Add a fallback to plural 'mechanisms' * Add a small testcase for increased coverage.
diff --git a/confluent_kafka/avro/__init__.py b/confluent_kafka/avro/__init__.py
@@ -33,7 +33,8 @@ def __init__(self, config, default_key_schema=None,
                    for key, value in config.items() if key.startswith("schema.registry")}
 
         if sr_conf.get("basic.auth.credentials.source") == 'SASL_INHERIT':
-            sr_conf['sasl.mechanisms'] = config.get('sasl.mechanisms', '')
+            # Fallback to plural 'mechanisms' for backward compatibility
+            sr_conf['sasl.mechanism'] = config.get('sasl.mechanism', config.get('sasl.mechanisms', ''))
             sr_conf['sasl.username'] = config.get('sasl.username', '')
             sr_conf['sasl.password'] = config.get('sasl.password', '')
             sr_conf['auto.register.schemas'] = config.get('auto.register.schemas', True)
@@ -111,7 +112,8 @@ def __init__(self, config, schema_registry=None, reader_key_schema=None, reader_
                    for key, value in config.items() if key.startswith("schema.registry")}
 
         if sr_conf.get("basic.auth.credentials.source") == 'SASL_INHERIT':
-            sr_conf['sasl.mechanisms'] = config.get('sasl.mechanisms', '')
+            # Fallback to plural 'mechanisms' for backward compatibility
+            sr_conf['sasl.mechanism'] = config.get('sasl.mechanism', config.get('sasl.mechanisms', ''))
             sr_conf['sasl.username'] = config.get('sasl.username', '')
             sr_conf['sasl.password'] = config.get('sasl.password', '')
 
diff --git a/confluent_kafka/avro/cached_schema_registry_client.py b/confluent_kafka/avro/cached_schema_registry_client.py
@@ -135,8 +135,8 @@ def _configure_basic_auth(url, conf):
             raise ValueError("schema.registry.basic.auth.credentials.source must be one of {}"
                              .format(VALID_AUTH_PROVIDERS))
         if auth_provider == 'SASL_INHERIT':
-            if conf.pop('sasl.mechanism', '').upper() is ['GSSAPI']:
-                raise ValueError("SASL_INHERIT does not support SASL mechanisms GSSAPI")
+            if conf.pop('sasl.mechanism', '').upper() == 'GSSAPI':
+                raise ValueError("SASL_INHERIT does not support SASL mechanism GSSAPI")
             auth = (conf.pop('sasl.username', ''), conf.pop('sasl.password', ''))
         elif auth_provider == 'USER_INFO':
             auth = tuple(conf.pop('basic.auth.user.info', '').split(':'))
diff --git a/examples/confluent_cloud.py b/examples/confluent_cloud.py
@@ -53,7 +53,7 @@
 
 p = Producer({
     'bootstrap.servers': '<ccloud bootstrap servers>',
-    'sasl.mechanisms': 'PLAIN',
+    'sasl.mechanism': 'PLAIN',
     'security.protocol': 'SASL_SSL',
     'sasl.username': '<ccloud key>',
     'sasl.password': '<ccloud secret>'
@@ -78,7 +78,7 @@ def acked(err, msg):
 
 c = Consumer({
     'bootstrap.servers': '<ccloud bootstrap servers>',
-    'sasl.mechanisms': 'PLAIN',
+    'sasl.mechanism': 'PLAIN',
     'security.protocol': 'SASL_SSL',
     'sasl.username': '<ccloud key>',
     'sasl.password': '<ccloud secret>',
diff --git a/tests/avro/test_cached_client.py b/tests/avro/test_cached_client.py
@@ -216,6 +216,15 @@ def test_basic_auth_sasl_inherit(self):
         })
         self.assertTupleEqual(('user_sasl', 'secret_sasl'), self.client._session.auth)
 
+    def test_basic_auth_sasl_inherit_invalid(self):
+        with self.assertRaises(ValueError) as e:
+            self.client = CachedSchemaRegistryClient({
+                'url': 'https://user_url:secret_url@127.0.0.1:65534',
+                'basic.auth.credentials.source': 'SASL_INHERIT',
+                'sasl.mechanism': 'gssapi'  # also test the .upper()
+            })
+        self.assertEqual(str(e.exception), "SASL_INHERIT does not support SASL mechanism GSSAPI")
+
     def test_basic_auth_invalid(self):
         with self.assertRaises(ValueError):
             self.client = CachedSchemaRegistryClient({
