KIP-368 — SASL re-authentication (partial)

Status: partial — see the KIP index.

What's missing

• A broker-wide connections.max.reauth.ms equivalent. kaas bounds sessions only where the credential itself expires: oauth listeners with maxSecondsWithoutReauthentication set. SCRAM/PLAIN sessions are never asked to re-authenticate (their session_lifetime_ms is always 0), which matches Apache's default but cannot be tightened per broker the way Apache allows.
• Apache closes an over-deadline connection after failing the next request; kaas keeps answering SASL_AUTHENTICATION_FAILED (58) to every non-SASL request instead of disconnecting. Cooperative clients re-authenticate or reconnect either way.

What landed

KIP-368 (Kafka 2.2) lets a client re-run the SASL exchange on a live connection before its session expires, with the broker advertising the deadline as session_lifetime_ms in the SaslAuthenticate response.

On an oauth listener with maxSecondsWithoutReauthentication set, a successful authentication advertises min(configured bound, token remaining lifetime) in milliseconds, and the dispatcher (crates/kaas-protocol/src/dispatch.rs) refuses every non-SASL API past the deadline until a fresh exchange completes — a connection cannot outlive its bearer token by more than the configured bound. Re-authentication is accepted on any listener at any time, with one guard (crates/kaas-broker/src/handlers/sasl.rs): the new exchange must resolve to the same principal — a re-auth that would swap identities fails with SASL_AUTHENTICATION_FAILED rather than laundering one principal's connection into another's.

How it's verified

exchange_session_lifetime_capped in crates/kaas-auth/src/oauth.rs pins the min(bound, token lifetime) arithmetic; oauthbearer_end_to_end_over_tls in bins/kaas/tests/oauth_smoke.rs asserts the advertised lifetime on the wire. The client half is exercised live by the canary pair, whose Kafka library re-authenticates on the broker's advertised timer.