Kafka SaslAuthenticate Response Wire Format v2 — Binary Protocol Layout

What is SaslAuthenticate?

Carries the raw SASL exchange bytes after SaslHandshake, with content specific to the mechanism (GSSAPI token, OAUTHBEARER JWT, SCRAM challenge-response, etc.). The response includes session lifetime for token-based mechanisms like OAUTHBEARER, so the client knows when to re-authenticate.

Schema
{
  "ErrorCode": int16,
  "ErrorMessage": string?,
  "AuthBytes": bytes,
  "SessionLifetimeMs": int64
}

Example
{
  "ErrorCode": 0,
  "ErrorMessage": "NETWORK_EXCEPTION",
  "AuthBytes": "<binary>",
  "SessionLifetimeMs": 0
}