logstash-integration-kafka 11.8.4-java → 11.8.5-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae9f90bf263aa267bb6809c88ada05a3cfe91e4f7a51e8613a7a2c5cd08ef5f0
-  data.tar.gz: ce4aae8cd2a07e9040a549f278fa81c4c30c59697336a82389fe5a20622980e9
+  metadata.gz: 6b695f9b526426ab9e7dd6017963b81f69d20083d54dc36a81c99784f23a695f
+  data.tar.gz: b34920fb15a9d7d1c9497e3fbc1b160cc70499bece99211b63865c56fe492d5e
 SHA512:
-  metadata.gz: ede376a34781c536f687df6defbabc418c90b5f6ec9a60f005945f5b59e6cd1d4dac265d7a5077732a0959ac213ec06ead542b84e2d06adfea69ea5e3604f416
-  data.tar.gz: adc663da616a174fd5a9e5e07c459cabd23f57941a053a41d60d01a9c10ca4c4b21607168a284f9673f52a7bbfff91121c12914d7889ab29c0af32991a539439
+  metadata.gz: bfd5ee3143bef4501ae61c3ec5301376d2e4365acd8b1cb7363de30ed8dff64d5b215803aaf7234fcafcc861cf7406aeb63a08cd196c18113f8750b995a0addd
+  data.tar.gz: 1befbc8a47cd22724b604116b7f6282dd03d3d3fb3d468d46dd4b973f9771f284e3dd5f3552585d371dcec3de153f2f322b0fc1316e11728c152d23734f43dc4

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 11.8.5
+  - Redact `sasl_jaas_config` to prevent credentials from appearing in debug logs. [#237](https://github.com/logstash-plugins/logstash-integration-kafka/pull/237)
+
 ## 11.8.4
   - Upgrade kafka-avro-serializer dependency [#225](https://github.com/logstash-plugins/logstash-integration-kafka/pull/225)
 

data/docs/index.asciidoc

@@ -1,7 +1,7 @@
 :plugin: kafka
 :type: integration
 :no_codec:
-:kafka_client: 3.9.1
+:kafka_client: 3.9.2
 
 ///////////////////////////////////////////
 START - GENERATED VARIABLES, DO NOT EDIT!

data/docs/input-kafka.asciidoc

@@ -2,7 +2,7 @@
 :plugin: kafka
 :type: input
 :default_codec: plain
-:kafka_client: 3.9.1
+:kafka_client: 3.9.2
 :kafka_client_doc: 39
 
 ///////////////////////////////////////////

data/docs/output-kafka.asciidoc

@@ -2,7 +2,7 @@
 :plugin: kafka
 :type: output
 :default_codec: plain
-:kafka_client: 3.9.1
+:kafka_client: 3.9.2
 :kafka_client_doc: 39
 
 ///////////////////////////////////////////

data/lib/logstash/inputs/kafka.rb

@@ -254,7 +254,7 @@ class LogStash::Inputs::Kafka < LogStash::Inputs::Base
   # different JVM instances.
   config :jaas_path, :validate => :path
   # JAAS configuration settings. This allows JAAS config to be a part of the plugin configuration and allows for different JAAS configuration per each plugin config.
-  config :sasl_jaas_config, :validate => :string
+  config :sasl_jaas_config, :validate => :password
   # Optional path to kerberos config file. This is krb5.conf style as detailed in https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html
   config :kerberos_config, :validate => :path
   # Option to add Kafka metadata like topic, message size and header key values to the event.

data/lib/logstash/plugin_mixins/kafka/common.rb

@@ -40,7 +40,7 @@ module LogStash module PluginMixins module Kafka
       end
 
       props.put("sasl.kerberos.service.name", sasl_kerberos_service_name) unless sasl_kerberos_service_name.nil?
-      props.put("sasl.jaas.config", sasl_jaas_config) unless sasl_jaas_config.nil?
+      props.put("sasl.jaas.config", sasl_jaas_config.value) unless sasl_jaas_config.nil?
       props.put("sasl.client.callback.handler.class", sasl_client_callback_handler_class) unless sasl_client_callback_handler_class.nil?
       props.put("sasl.oauthbearer.token.endpoint.url", sasl_oauthbearer_token_endpoint_url) unless sasl_oauthbearer_token_endpoint_url.nil?
       props.put("sasl.oauthbearer.scope.claim.name", sasl_oauthbearer_scope_claim_name) unless sasl_oauthbearer_scope_claim_name.nil?

data/lib/logstash-integration-kafka_jars.rb

@@ -1,16 +1,16 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. DO NOT EDIT.
 
 require 'jar_dependencies'
-require_jar('io.confluent', 'kafka-avro-serializer', '7.9.3')
-require_jar('org.apache.kafka', 'kafka-clients', '3.9.1')
+require_jar('io.confluent', 'kafka-avro-serializer', '7.9.5')
+require_jar('org.apache.kafka', 'kafka-clients', '3.9.2')
 require_jar('at.yawk.lz4', 'lz4-java', '1.10.1')
-require_jar('io.confluent', 'kafka-schema-serializer', '7.9.3')
-require_jar('io.confluent', 'kafka-schema-registry-client', '7.9.3')
+require_jar('io.confluent', 'kafka-schema-serializer', '7.9.5')
+require_jar('io.confluent', 'kafka-schema-registry-client', '7.9.5')
 require_jar('org.apache.avro', 'avro', '1.11.4')
 require_jar('org.apache.commons', 'commons-compress', '1.28.0')
 require_jar('com.google.guava', 'guava', '32.0.1-jre')
 require_jar('io.confluent', 'logredactor', '1.0.12')
-require_jar('io.confluent', 'common-utils', '7.9.3')
+require_jar('io.confluent', 'common-utils', '7.9.5')
 require_jar('com.github.luben', 'zstd-jni', '1.5.6-4')
 require_jar('org.xerial.snappy', 'snappy-java', '1.1.10.5')
 require_jar('org.slf4j', 'slf4j-api', '1.7.36')

data/logstash-integration-kafka.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = 'logstash-integration-kafka'
-  s.version         = '11.8.4'
+  s.version         = '11.8.5'
   s.licenses        = ['Apache-2.0']
   s.summary         = "Integration with Kafka - input and output plugins"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline "+

data/spec/integration/inputs/kafka_spec.rb

@@ -187,6 +187,53 @@ describe "inputs/kafka", :integration => true do
     end
   end
 
+  # ToDo: add tests for other sasl config options as well (https://github.com/logstash-plugins/logstash-integration-kafka/issues/234)
+  context 'setting sasl_jaas_config' do
+    let(:base_config) do
+      {
+        'topics' => ['logstash_integration_topic_plain'],
+        'group_id' => rand(36**8).to_s(36),
+      }
+    end
+
+    shared_examples 'sasl_jaas_config password handling' do
+      it 'stores sasl_jaas_config as password type' do
+        kafka_input = LogStash::Inputs::Kafka.new(consumer_config)
+        expect(kafka_input.sasl_jaas_config).to be_a(LogStash::Util::Password)
+        expect(kafka_input.sasl_jaas_config.value).to eq(jaas_config_value)
+      end
+
+      it 'does not expose password in inspect output' do
+        kafka_input = LogStash::Inputs::Kafka.new(consumer_config)
+        expect(kafka_input.sasl_jaas_config.inspect).to eq('<password>')
+        expect(kafka_input.sasl_jaas_config.inspect).not_to include('admin-secret')
+      end
+    end
+
+    context 'with single-line config' do
+      let(:jaas_config_value) { 'org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin-secret";' }
+      let(:consumer_config) { base_config.merge('sasl_jaas_config' => jaas_config_value) }
+
+      include_examples 'sasl_jaas_config password handling'
+    end
+
+    context 'with multiline config' do
+      let(:jaas_config_value) do
+        <<~JAAS
+          org.apache.kafka.common.security.plain.PlainLoginModule required
+            username="admin"
+            password="admin-secret"
+            user_admin="admin-secret"
+            user_alice="alice-secret";
+        JAAS
+      end
+      let(:consumer_config) { base_config.merge('sasl_jaas_config' => jaas_config_value) }
+
+      include_examples 'sasl_jaas_config password handling'
+    end
+  end
+
+
   context "static membership 'group.instance.id' setting" do
     let(:base_config) do
       {

data/spec/unit/inputs/kafka_spec.rb

@@ -264,6 +264,43 @@ describe LogStash::Inputs::Kafka do
 
       expect(subject.send(:create_consumer, 'test-client-2', 'group_instance_id')).to be kafka_client
     end
+
+    context 'with sasl_jaas_config' do
+      shared_examples 'sasl_jaas_config password handling' do
+        it "sasl_jaas_config.value returns the original string" do
+          subject.register
+          expect(subject.sasl_jaas_config.value).to eq(jaas_config_value)
+        end
+
+        it "sasl_jaas_config.inspect does not expose the password" do
+          subject.register
+          expect(subject.sasl_jaas_config.inspect).not_to include('admin-secret')
+          expect(subject.sasl_jaas_config.inspect).to eq('<password>')
+        end
+      end
+
+      context 'with single-line config' do
+        let(:jaas_config_value) { 'org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin-secret";' }
+        let(:config) { super().merge('sasl_jaas_config' => jaas_config_value) }
+
+        include_examples 'sasl_jaas_config password handling'
+      end
+
+      context 'with multiline config' do
+        let(:jaas_config_value) {
+          <<~JAAS
+            org.apache.kafka.common.security.plain.PlainLoginModule required
+              username="admin"
+              password="admin-secret"
+              user_admin="admin-secret"
+              user_alice="alice-secret";
+          JAAS
+        }
+        let(:config) { super().merge('sasl_jaas_config' => jaas_config_value) }
+
+        include_examples 'sasl_jaas_config password handling'
+      end
+    end
   end
 
   describe "schema registry" do

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: logstash-integration-kafka
 version: !ruby/object:Gem::Version
-  version: 11.8.4
+  version: 11.8.5
 platform: java
 authors:
 - Elastic
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-19 00:00:00.000000000 Z
+date: 2026-03-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
+  name: logstash-core-plugin-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -19,7 +19,6 @@ dependencies:
     - - "<="
       - !ruby/object:Gem::Version
         version: '2.99'
-  name: logstash-core-plugin-api
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -31,12 +30,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.99'
 - !ruby/object:Gem::Dependency
+  name: logstash-core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: 8.3.0
-  name: logstash-core
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -45,12 +44,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 8.3.0
 - !ruby/object:Gem::Dependency
+  name: logstash-codec-json
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-codec-json
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -59,12 +58,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
+  name: logstash-codec-plain
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-codec-plain
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -73,6 +72,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
+  name: stud
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -81,7 +81,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: 0.1.0
-  name: stud
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -93,6 +92,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.1.0
 - !ruby/object:Gem::Dependency
+  name: manticore
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -101,7 +101,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: 1.0.0
-  name: manticore
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -113,12 +112,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 1.0.0
 - !ruby/object:Gem::Dependency
+  name: logstash-mixin-deprecation_logger_support
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
-  name: logstash-mixin-deprecation_logger_support
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -127,12 +126,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
+  name: logstash-devutils
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-devutils
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -141,12 +140,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
+  name: logstash-codec-line
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: logstash-codec-line
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -155,12 +154,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
+  name: rspec-wait
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: rspec-wait
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -169,12 +168,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
+  name: digest-crc
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.5.1
-  name: digest-crc
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -183,12 +182,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.5.1
 - !ruby/object:Gem::Dependency
+  name: ruby-kafka
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: ruby-kafka
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -197,12 +196,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
+  name: snappy
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  name: snappy
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -260,17 +259,17 @@ files:
 - vendor/jar-dependencies/com/google/re2j/re2j/1.6/re2j-1.6.jar
 - vendor/jar-dependencies/commons-codec/commons-codec/1.19.0/commons-codec-1.19.0.jar
 - vendor/jar-dependencies/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar
-- vendor/jar-dependencies/io/confluent/common-utils/7.9.3/common-utils-7.9.3.jar
-- vendor/jar-dependencies/io/confluent/kafka-avro-serializer/7.9.3/kafka-avro-serializer-7.9.3.jar
-- vendor/jar-dependencies/io/confluent/kafka-schema-registry-client/7.9.3/kafka-schema-registry-client-7.9.3.jar
-- vendor/jar-dependencies/io/confluent/kafka-schema-serializer/7.9.3/kafka-schema-serializer-7.9.3.jar
+- vendor/jar-dependencies/io/confluent/common-utils/7.9.5/common-utils-7.9.5.jar
+- vendor/jar-dependencies/io/confluent/kafka-avro-serializer/7.9.5/kafka-avro-serializer-7.9.5.jar
+- vendor/jar-dependencies/io/confluent/kafka-schema-registry-client/7.9.5/kafka-schema-registry-client-7.9.5.jar
+- vendor/jar-dependencies/io/confluent/kafka-schema-serializer/7.9.5/kafka-schema-serializer-7.9.5.jar
 - vendor/jar-dependencies/io/confluent/logredactor-metrics/1.0.12/logredactor-metrics-1.0.12.jar
 - vendor/jar-dependencies/io/confluent/logredactor/1.0.12/logredactor-1.0.12.jar
 - vendor/jar-dependencies/io/swagger/core/v3/swagger-annotations/2.1.10/swagger-annotations-2.1.10.jar
 - vendor/jar-dependencies/org/apache/avro/avro/1.11.4/avro-1.11.4.jar
 - vendor/jar-dependencies/org/apache/commons/commons-compress/1.28.0/commons-compress-1.28.0.jar
 - vendor/jar-dependencies/org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar
-- vendor/jar-dependencies/org/apache/kafka/kafka-clients/3.9.1/kafka-clients-3.9.1.jar
+- vendor/jar-dependencies/org/apache/kafka/kafka-clients/3.9.2/kafka-clients-3.9.2.jar
 - vendor/jar-dependencies/org/checkerframework/checker-qual/3.33.0/checker-qual-3.33.0.jar
 - vendor/jar-dependencies/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar
 - vendor/jar-dependencies/org/xerial/snappy/snappy-java/1.1.10.5/snappy-java-1.1.10.5.jar
@@ -282,7 +281,6 @@ metadata:
   logstash_plugin: 'true'
   logstash_group: integration
   integration_plugins: logstash-input-kafka,logstash-output-kafka
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -298,8 +296,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
-signing_key:
+rubygems_version: 3.6.3
 specification_version: 4
 summary: Integration with Kafka - input and output plugins
 test_files: