Module sasl 

Transport-agnostic outbound SASL handshake for the client.

outbound_sasl drives the client side of Kafka’s SaslHandshake + SaslAuthenticate exchange over any AsyncRead + AsyncWrite stream. That stream can be a plaintext TcpStream, a tokio_rustls TLS stream, or an in-process duplex for tests. It supports PLAIN with one round-trip, SCRAM-SHA-256/512 with two round-trips and server-final verification, OAUTHBEARER with the RFC 7628 success/failure exchange, and GSSAPI with multi-round AP-REQ / AP-REP plus RFC 4752 security-layer negotiation. The GSSAPI client needs the gssapi Cargo feature and an operating system: a build without the feature, or for WebAssembly, fails GSSAPI with SaslAuthenticationError::UnsupportedMechanism.

This is the shared implementation the broker’s inter-broker dialer and the public clients both call. The only difference is the credentials value and the reporter client_id.

Structs

SaslSession

What a completed SASL exchange leaves for re-authentication.

Enums

OAuthBearerTokenSource

Where an OAUTHBEARER exchange gets its token.

OutboundSaslError

Errors raised during the outbound SASL handshake.

SaslAuthenticationError

A SASL authentication rejection. Each variant is a subclass of Kafka’s AuthenticationException, which the client raises to the application without a retry.

SaslCredentials

Outbound SASL credentials.

Functions

outbound_sasl

Run the outbound SASL handshake to completion over stream.