Crate krabka_security 

Security primitives used by Krabka brokers, clients, and tooling.

The crate owns the protocol-independent pieces of TLS, SASL, SCRAM, OAuth/OIDC, mTLS principal extraction, delegation-token HMACs, Kerberos exchange state, and principal modelling. Network I/O stays in the caller. The async IntrospectionClient trait represents OAuth introspection, and the broker and client crates supply the concrete transports and wire the resulting validators into listener or connection handshakes.

SASL/PLAIN verification

use std::collections::HashMap;

use krabka_security::{AuthMethod, verify_plain};

let mut users = HashMap::new();
users.insert("alice".to_string(), "wonderland".to_string());

let principal = verify_plain(&users, "alice", b"wonderland").unwrap();
assert_eq!(principal.name, "alice");
assert_eq!(principal.auth_method, AuthMethod::SaslPlain);

Storing SCRAM credentials

use krabka_security::{SaslMechanism, hash_scram_password};

let credential = hash_scram_password(
    b"correct horse battery staple",
    SaslMechanism::ScramSha512,
    4096,
)?;
assert_eq!(credential.iterations, 4096);

Cargo features

• gssapi (off by default): SASL/GSSAPI (Kerberos), the gssapi module. It is native-only, and has no effect on wasm32 targets.

gssapi stays out of default on purpose. The Kerberos stack it pulls in, sspi, depends on rsa 0.10, which carries RUSTSEC-2023-0071 (the Marvin timing side channel) and has no patched release. A build without the feature compiles no rsa at all. A build with it is still not exposed, because Krabka’s GSSAPI path uses only AES keytab keys and never runs an RSA private-key operation; docs/rustsec-2023-0071.md in the repository gives the reachability analysis.

Without the feature, SaslMechanism::Gssapi still parses and still names the mechanism in persisted metadata, but SaslMechanism::is_available returns false for it and SaslMechanism::require_available returns AuthError::UnsupportedMechanism. A broker maps that to Kafka’s UNSUPPORTED_SASL_MECHANISM (error code 33) in the SaslHandshake response, and a client reports it before it opens a connection.

Re-exports

pub use delegation_token::SecretBytes;

pub use delegation_token::compute_token_hmac;

pub use scram::ScramClientExchange;

pub use scram::ScramClientFirst;

pub use scram::ScramCredential;

pub use scram::ScramError;

pub use scram::ScramServerExchange;

pub use scram::StepResult;

pub use scram::TOKEN_AUTH_EXTENSION;

pub use scram::decode_saslname;

pub use scram::derive_keys_from_salted;

pub use scram::encode_saslname;

pub use scram::hash_scram_password;

pub use scram::pbkdf2_salted;

pub use scram::scram_hash_len;

Modules

ca

Pure X.509 CA + leaf-cert generation for the operator’s clients-CA bootstrap. Inter-broker mTLS and cert hot-reload tests can reuse it.

delegation_token

KIP-48 delegation token primitives: the HMAC and a secret-key wrapper that keeps the bytes out of Debug.

java_regex

java.util.regex match and replacement semantics over the regex crate.

scram

SCRAM (RFC 5802) with support for SHA-256 and SHA-512.

Structs

AuthOutcome

Outcome of an OAUTHBEARER validation: the authenticated principal plus the token’s expiry.

ClientInitialResponse

Parsed RFC 7628 client initial response.

DynamicServerConfig

Atomically swappable wrapper around a [rustls::ServerConfig].

IntrospectionValidator

RFC 7662 opaque-token introspection validator.

InvalidScopeItem

A required-scope item outside Kafka’s scope-token grammar (%x21 / %x23-5B / %x5D-7E, RFC 6749 §3.3), as parse_required_scope reports it.

Jwks

A parsed JWK key set.

JwksHandle

A cheaply-clonable, atomically-swappable holder for the live Jwks.

KafkaPrincipal

KIP-48: Kafka wire-level principal.

Principal

SignedJwsValidator

Validates a signed JWS bearer token (RS256 / ES256) against a JWKS key set from the identity provider.

TlsConfig

UnsecuredJwsValidator

Validates an unsecured JWS bearer token (alg: none) and derives the connection principal. Mirrors Kafka’s OAuthBearerUnsecuredValidatorCallbackHandler.

Enums

AuthError

AuthMethod

How a Principal was authenticated.

ClientAuthMode

Whether the server requests and verifies a client certificate during the TLS handshake, per RFC 5246 §7.4.6, which is Kafka’s mTLS path.

IntrospectionError

Transport-layer failures that IntrospectionClient reports.

JwksTrustError

ListenerProtocol

OAuthBearerValidator

The broker’s configured OAUTHBEARER token validator.

SaslMechanism

TlsError

Traits

IntrospectionClient

HTTP transport contract for RFC 7662 introspection + OIDC userinfo.

Functions

build_client_config_from_pem

Read a PEM bundle of one or more CA certificates and produce a rustls::ClientConfig that trusts exactly those certificates.

extract_principal_from_cert

Parse cert_der and return the Subject DN in RFC 2253 format.

oauth_error_json

The RFC 7628 server error challenge for a failed OAUTHBEARER validation, byte for byte what Kafka 4.3.1’s OAuthBearerSaslServer.jsonErrorResponse sends.

parse_client_initial_response

Parse the SASL/OAUTHBEARER client initial response (RFC 7628 §3.1).

parse_required_scope

Parse Kafka’s unsecuredValidatorRequiredScope option the way Kafka 4.3.1’s OAuthBearerUnsecuredValidatorCallbackHandler does.

verify_plain

Verifies a SASL/PLAIN auth attempt against a static credential map.