Skip to main content

token_api_admission

krabka_verified::delegation_token

Function token_api_admission 

Source 
pub fn token_api_admission(
    has_authenticated_identity: bool,
    authenticated_via_token: bool,
    _api: TokenApi,
) -> TokenApiAdmission
Expand description

Admit delegation-token APIs only for a securely authenticated, non-token identity.

Matches KafkaApis.allowTokenRequests: a delegation-token-authenticated identity may not invoke ANY delegation-token API, including DescribeDelegationToken. KIP-48 forbids a token-issued session from bootstrapping further token access; letting it describe would leak the HMACs of every other token the same owner holds. The host adapter is responsible for treating an anonymous listener principal as unauthenticated.