Store delegation token hmac as base64 #1628
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR completes a TODO left in the code from #1626
Delegation tokens are created by a super user and allows a connection to kafka to authenticate as a specific user.
Shotover creates them to allow proxying scram connections which would otherwise be unable to be proxied.
The token task in scram_over_mtls.rs creates delegation tokens when the transforms request them.
It will cache the token and fetch new tokens if they are not in the cache yet.
The tokens are stored in a type called
DelegationToken
.This contains the
token_id
which acts as the tokens username and thehmac
which acts as the tokens password.shotover-proxy/shotover/src/transforms/kafka/sink_cluster/scram_over_mtls.rs
Lines 328 to 333 in c1331f8
Currently the
hmac
field stores the raw bytes of the hmac, in aVec<u8>
.This PR changes the
hmac
field to instead store the base64 encoding of the hmac, in aStrBytes
.This is more efficient as we dont need to convert to base64 every time we use the hmac to login with token.