[beryllw]

Purpose

Closes #3837.

Allow gateways and other services to authenticate with their own SASL/PLAIN credentials and act as explicitly authorized end users, so existing ACL checks use the effective user's principal.

Brief change log

• Add client.security.sasl.authorization-id and pass it to Sasl.createSaslClient. An unset, empty, or identical authorization identity retains the authenticated account. Existing username/password and JAAS configuration are reused.
• After verifying PLAIN credentials, use the standard AuthorizeCallback to check proxy grants in security.sasl.proxy-users. Support literal targets, *, and full-string regex: matches. Reject missing grants, disallowed targets, and super-user targets, respecting the ACL principal case policy.
• Configure server authentication plugins during protocol setup and prepare immutable SASL proxy grants before accepting connections. Retain the existing per-connection authenticator creation API, independent authentication state, and credential hot reload. Log successful impersonation at INFO with CR/LF escaped.
• Extend the existing authentication and ACL test suites.

Tests

• Java 11 clean verify for fluss-common, fluss-rpc, fluss-server, and fluss-client with their reactor dependencies, explicitly running 105 related unit and integration test cases based on main at 5bdb5679a. Use -Dfluss.forkCount=1 to avoid a local test-port collision encountered in the initial parallel run.
• Existing PLAIN tests cover authorization-ID transmission, empty/default identity, JAAS credentials, rejected/unsupported authorization callbacks, grant matching, escaped audit logs, configuration quoting, invalid patterns, super-user protection, and independent connection state.
• Existing plugin factory tests cover initialization before creation, one initialization per loaded plugin, and independent authenticator instances.
• Existing RPC tests cover authentication, credential additions/removals with and without impersonation, and invalid grants rejected during setup. Existing ACL integration tests verify permissions are evaluated for the requested user.
• Java 8 API compilation of changed Java sources, Spotless, Checkstyle, and license checks.

API and Format

Adds an optional SASL client authorization-ID setting and a server proxy-grant option. Uses the existing SASL/PLAIN wire format and authentication RPC.

Adds a default ServerAuthenticationPlugin.configure(Configuration) method for startup initialization. Existing plugins inherit a no-op implementation. The original createServerAuthenticator(Configuration) signature, per-connection creation behavior, and storage formats are unchanged.

Documentation

The authentication guide explains SASL/PLAIN impersonation, proxy grants, regex quoting, and client configuration.

• Generative AI assistance used (OpenAI Codex).

[beryllw]

Thanks a lot for the review, @litiliu!
@loserwang1024 could you take a look when you get a chance?

[litiliu]

One compatibility concern with #3047: FlussProtocolPlugin materializes security.sasl.plain.credentials into security.sasl.plain.jaas.config by parsing and regenerating only user_* options. This PR introduces impersonate_* as a non-credential JAAS option, so it will be silently dropped whenever the credentials map is configured or dynamically updated.

Is impersonation intentionally unsupported together with security.sasl.plain.credentials? If not, the JAAS regeneration should preserve impersonate_*, with tests covering both startup and dynamic credentials updates.

[beryllw]

I'll open a follow-up PR to support dynamically altering the impersonation grants themselves.

[Copilot]

Pull request overview

This PR implements end-to-end SASL/PLAIN impersonation (RFC 4616 authorization id) so a client can authenticate as one user (authcid) while requesting an effective principal (authzid), with server-side authorization gated by impersonate_<authcid> JAAS options.

Changes:

• Add client config client.security.sasl.authorization-id and plumb it into SASL client creation.
• Allow server-side impersonation via AuthorizeCallback + JAAS impersonate_<user> allowlist (including * wildcard).
• Improve/extend tests and harden JAAS config materialization logic used during credential reconfiguration.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
fluss-rpc/src/test/java/org/apache/fluss/rpc/netty/server/FlussProtocolPluginTest.java	Adds unit coverage for JAAS config regeneration/materialization behavior.
fluss-rpc/src/test/java/org/apache/fluss/rpc/netty/authenticate/SaslAuthenticationITCase.java	Extends IT coverage to include an impersonation-capable SASL client configuration during reconfigure tests.
fluss-rpc/src/main/java/org/apache/fluss/rpc/netty/server/FlussProtocolPlugin.java	Reworks PLAIN JAAS config materialization to preserve baseline options and overlay credentials safely.
fluss-common/src/test/java/org/apache/fluss/security/auth/sasl/plain/PlainSaslServerTest.java	Adds unit tests for allowed/denied impersonation scenarios and expected error messages.
fluss-common/src/main/java/org/apache/fluss/security/auth/sasl/plain/PlainServerCallbackHandler.java	Adds AuthorizeCallback handling and JAAS-driven impersonation allowlist parsing.
fluss-common/src/main/java/org/apache/fluss/security/auth/sasl/plain/PlainSaslServer.java	Enforces impersonation authorization via callback, sets effective authorization id, and logs impersonation.
fluss-common/src/main/java/org/apache/fluss/security/auth/sasl/jaas/SaslServerFactory.java	Updates SASL client creation to accept an explicit authorization id.
fluss-common/src/main/java/org/apache/fluss/security/auth/sasl/authenticator/SaslClientAuthenticator.java	Reads the new authorization-id option and passes it into SASL client creation.
fluss-common/src/main/java/org/apache/fluss/config/ConfigOptions.java	Introduces client.security.sasl.authorization-id config option and documentation.
fluss-client/src/test/java/org/apache/fluss/client/security/acl/FlussAuthorizationITCase.java	Adds an end-to-end authorization test demonstrating proxy-user impersonation effects on ACL evaluation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

This PR has been marked as stale because it has had no activity for 60 days. It will be closed in 10 days unless it receives a new comment, commit or other update.

[beryllw]

@loserwang1024 cc

[loserwang1024]

LGTM