Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Authenticate using SASL/SCRAM-SHA-512 in Kafka SASL_SSL scenarios as PLAIN authentication doesn't work in FIPS-enabled environment #1091

Merged
merged 1 commit into from
Apr 20, 2024
Merged

Authenticate using SASL/SCRAM-SHA-512 in Kafka SASL_SSL scenarios as PLAIN authentication doesn't work in FIPS-enabled environment #1091

merged 1 commit into from
Apr 20, 2024

Conversation

michalvavrik
Copy link
Member

@michalvavrik michalvavrik commented Apr 20, 2024 •
edited
Loading

Summary

This PR makes our SASL_SSL tests pass in FIPS-enabled environment once we migrate them to SCRAM-SHA-512. It's also safer and more likely to be used in production, so win-win. This PR has no relation to OCP tests and is tested in FW by StrimziKafkaWithDefaultSaslSslMessagingIT. On FIPS I used KafkaSaslSslIT with additional changes.

Please check the relevant options

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Dependency update
  • Refactoring
  • Breaking change (fix or feature that would cause existing functionality to change)
  • This change requires a documentation update
  • This change requires execution against OCP (use run tests phrase in comment)

Checklist:

  • Example scenarios has been updated / added
  • Methods and classes used in PR scenarios are meaningful
  • Commits are well encapsulated and follow the best practices

@michalvavrik michalvavrik changed the title Authenticate using SASL/SCRAM-SHA-512 in SASL_SSL scenarios as PLAIN authentication doesn't work in FIPS-enabled environment Authenticate using SASL/SCRAM-SHA-512 in Kafka SASL_SSL scenarios as PLAIN authentication doesn't work in FIPS-enabled environment Apr 20, 2024
@michalvavrik michalvavrik requested a review from gtroitsk April 20, 2024 11:22
@michalvavrik
Copy link
Member Author

michalvavrik commented Apr 20, 2024 •
edited
Loading

Asking @gtroitsk for review as this PR adds compatibility for FIPS to recently added SASL_SSL test coverage in TS by him. cc @mjurc

@michalvavrik michalvavrik force-pushed the feature/sasl_ssl_fips branch from d9c1370 to d5d04ea Compare April 20, 2024 13:58
gtroitsk
gtroitsk approved these changes Apr 20, 2024
View reviewed changes
Copy link
Member

@gtroitsk gtroitsk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you

@michalvavrik michalvavrik merged commit 6e37048 into quarkus-qe:main Apr 20, 2024
8 checks passed
@michalvavrik michalvavrik deleted the feature/sasl_ssl_fips branch April 20, 2024 15:10
@michalvavrik michalvavrik mentioned this pull request Apr 23, 2024
Merged
11 tasks
@michalvavrik michalvavrik added the triage/backport-1.4? Quarkus 3.8 stream label Apr 26, 2024
@michalvavrik michalvavrik removed the triage/backport-1.4? Quarkus 3.8 stream label May 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gtroitsk gtroitsk gtroitsk approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@michalvavrik @gtroitsk