KIP-432 — Additional Broker-Side Opt-In for Default, Unsecure SASL/OAUTHBEARER Implementation

Discarded Security

KIP-432 (discarded) proposed adding an explicit opt-in broker config (e.g. `sasl.oauthbearer.unsecured.enable=true`) required before the default unsecured SASL/OAUTHBEARER implementation would authenticate clients, so that accidentally enabling OAUTHBEARER in `sasl.enabled.mechanisms` would not open an unauthenticated login path. The default unsecured OAUTHBEARER implementation trusts any token the client presents, and a simple misconfiguration could allow any client to impersonate any principal.

Details