Skip to main content

parse_client_initial_response

krabka_security

Function parse_client_initial_response 

Source 
pub fn parse_client_initial_response(
    bytes: &[u8],
) -> Result<ClientInitialResponse, AuthError>
Expand description

Parse the SASL/OAUTHBEARER client initial response (RFC 7628 §3.1).

The grammar is the one that Kafka 4.3.1’s org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerClientInitialResponse matches against the whole message (^A = \x01):

message  = "n," ["a=" saslname] "," ^A *(key "=" value ^A) ^A
saslname = 1*([\x01-\x7F] except "=" and "," / "=2C" / "=3D")
key      = 1*[A-Za-z]
value    = 1*[\x21-\x7E SP HTAB CR LF]
auth     = scheme 1*SP token
scheme   = 1*[A-Za-z0-9_]
token    = 1*[-_~+/.A-Za-z0-9] *"="

The channel-binding flag must be n. The authzid is returned verbatim: Kafka does not decode =2C or =3D. An empty authzid is None. The auth kvpair is required, and its scheme must be Bearer in any letter case. If auth occurs more than once, the last one wins, as in Kafka’s map. The other kvpairs (SASL extensions such as host and port) must match the grammar, but this function does not return them.

§Errors

AuthError::MalformedMessage when the message does not match the grammar, when the auth kvpair is missing, or when its scheme is not Bearer.