Class CpcSniLkcVerifier

java.lang.Object

io.confluent.kafka.cpc.multitenant.CpcSniLkcVerifier

All Implemented Interfaces:

org.apache.kafka.common.Configurable, org.apache.kafka.common.network.SniLkcVerifier

public class CpcSniLkcVerifier
extends Object
implements org.apache.kafka.common.network.SniLkcVerifier, org.apache.kafka.common.Configurable

CPC implementation of SniLkcVerifier that validates logical cluster IDs against the broker's BasePhysicalClusterMetadata.

When a client connects with an unknown LKC via SNI, this verifier throws AuthenticationException during the TLS handshake or KafkaChannel.prepare(), before authentication starts. This ensures the client receives a proper auth-failure response instead of an EOF/connection-reset.

Verification is scoped to multitenant listeners only (configured via confluent.multitenant.listener.names). Connections on non-multitenant listeners are allowed through without LKC checks.

Field Summary

Fields inherited from interface org.apache.kafka.common.network.SniLkcVerifier

NO_OP

Constructor Summary

Constructors

Constructor	Description
CpcSniLkcVerifier()

Method Summary

Modifier and Type	Method	Description
void	configure(Map<String,?> configs)
void	verify(org.apache.kafka.common.security.authenticator.PathAwareSniHostName sniHostName, String listenerName)

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CpcSniLkcVerifier

public CpcSniLkcVerifier()

Method Details

configure

public void configure(Map<String,?> configs)

Specified by:

configure in interface org.apache.kafka.common.Configurable

verify

public void verify(org.apache.kafka.common.security.authenticator.PathAwareSniHostName sniHostName,
 String listenerName)
            throws org.apache.kafka.common.errors.AuthenticationException

Specified by:

verify in interface org.apache.kafka.common.network.SniLkcVerifier

Throws:

org.apache.kafka.common.errors.AuthenticationException