[litiliu]

Purpose

Linked issue: close #3495

This PR adds built-in SASL/OAUTHBEARER authentication to the native Fluss RPC layer. It allows clients to obtain JWT access tokens through the OAuth 2.0 Client Credentials grant, validates those tokens against server-side JWKS, issuer, audience, and lifetime requirements, maps the validated sub claim to FlussPrincipal, and reuses the existing ACL authorization flow.

Brief change log

• Add an OAUTHBEARER client authenticator that obtains access tokens from a configured OAuth 2.0 token endpoint using the Client Credentials grant.
• Add server-side RS256 JWT validation, including JWKS resolution, signature verification, issuer/audience checks, token lifetime checks, and sub principal mapping.
• Share the JWKS resolver across server connections, refresh cached keys on an unknown kid with rate limiting, and reject an authenticated connection after its JWT expires.
• Support PLAIN and OAUTHBEARER through the same SASL plugin while keeping each connection's authenticator independent.
• Add client and server OAUTHBEARER configuration options, with client secrets represented as Password values and redacted from configuration logs.
• Add focused unit and integration coverage for token acquisition, JWT validation failures, JWKS refresh behavior, principal creation, session expiration, and existing SASL authentication behavior.
• Document the OAUTHBEARER client/server configuration and runtime lifecycle.

Tests

• ./mvnw -q -pl fluss-common -Dtest=SaslAuthenticatorFactoryTest,OAuthBearerAuthenticationTest -Dsurefire.failIfNoSpecifiedTests=false test
  • 8 tests passed.
• ./mvnw -q -pl fluss-rpc -am -Dtest=SaslAuthenticationITCase -Dsurefire.failIfNoSpecifiedTests=false -DskipITs test
  • 12 tests passed.
• git diff --check codex/fluss-3495-sasl-pr1..HEAD

API and Format

• Adds client and server configuration options for selecting OAUTHBEARER, retrieving access tokens, and validating JWTs through JWKS, issuer, and audience settings.
• Adds a backward-compatible default ServerAuthenticator#validateSession() hook so an authenticated connection can be rejected after its JWT expires.
• Adds the jose4j runtime dependency for JWT/JWKS processing.
• No protobuf, RPC wire format, or storage format changes.

Documentation

Updated website/docs/security/authentication.md with OAUTHBEARER client and server configuration, Client Credentials behavior, JWKS caching/refresh behavior, token/session lifetime behavior, and configuration examples.

[github-actions]

This PR has been marked as stale because it has had no activity for 60 days. It will be closed in 10 days unless it receives a new comment, commit or other update.