Sylwester Lachiewicz created THRIFT-6206:
--------------------------------------------
Summary: Go: Add SASL / Kerberos Authentication Transport support
(TSaslTransport)
Key: THRIFT-6206
URL: https://issues.apache.org/jira/browse/THRIFT-6206
Project: Thrift
Issue Type: New Feature
Components: Go - Library
Reporter: Sylwester Lachiewicz
Currently, Apache Thrift provides SASL transport support across major language
libraries including Java (TSaslClientTransport / TSaslServerTransport), C++,
and Python, which are standard for authenticating Thrift services against
Kerberos/GSSAPI (e.g., Apache Hive, Impala, HBase). However, the Go library
(lib/go/thrift) currently lacks SASL transport support, requiring Go consumers
to either maintain custom forks or implement ad-hoc transport wrappers.
### Proposed Solution
Implement TSaslClientTransport in lib/go/thrift adhering to Thrift's standard
SASL negotiation framing:
1. Framing & Protocol:
- Status byte headers: START (1), OK (2), BAD (3), ERROR (4), COMPLETE (5),
followed by 4-byte big-endian payload length.
- Message payload negotiation loop handling challenge-response handshakes.
2. Pluggable Mechanism Interface:
- Define a zero-dependency interface (SaslClientMechanism) in lib/go/thrift
for negotiation (Start, Step, IsComplete, Dispose).
3. Pure-Go Built-in Mechanisms & Extensibility:
- Provide a built-in PLAIN mechanism with zero third-party dependencies.
- Allow external providers (such as GSSAPI / Kerberos via pure-Go libraries
like gokrb5) to be plugged in via the interface without adding heavy external
dependencies to Thrift's core go.mod.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
