What is CreateDelegationToken?
Issues short-lived tokens that replace static SASL credentials, suited for job schedulers and ephemeral services. Tokens can be distributed to workers via a secure channel, eliminating the need to share the actual Kerberos keytab or SCRAM password.
Wire Diagram
Response Header
message_size
int32 · 4B
correlation_id
int32 · 4B
CreateDelegationTokenResponse v1
ErrorCode
int16 · 2B
PrincipalType
string
PrincipalName
string
IssueTimestampMs
int64 · 8B
ExpiryTimestampMs
int64 · 8B
MaxTimestampMs
int64 · 8B
TokenId
string
Hmac
bytes
ThrottleTimeMs
int32 · 4B
Schema & Example
Schema { "ErrorCode": int16, "PrincipalType": string, "PrincipalName": string, "IssueTimestampMs": int64, "ExpiryTimestampMs": int64, "MaxTimestampMs": int64, "TokenId": string, "Hmac": bytes, "ThrottleTimeMs": int32 }
Example { "ErrorCode": 0, "PrincipalType": "User:alice", "PrincipalName": "User:alice", "IssueTimestampMs": 0, "ExpiryTimestampMs": 0, "MaxTimestampMs": 0, "TokenId": "abc-123", "Hmac": "<binary>", "ThrottleTimeMs": 0 }