SASL SCRAM support about kafka-proxy

[everesio]

Should be SCRAM be performed by clients i.e. pass through the proxy or initiated by the proxy i.e. hidden to the clients ? Both options are supported for PLAINTEXT.

Feel free to contribute.

[worms]

Our usecase would do plaintext to the proxy then scram over SSL/TLS out to the brokers.

I am looking at adding support now. I would like your input on how I am going about it.

Add new command line parameters to the server:
Server.Flags().StringVar(&c.Kafka.SASL.Method, "sasl-method", "PLAIN", "SASL method to use (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512")

Add a new struct called SASLSCRAMAuth.
If the sasl method is SCRAM-SHA-* then use the new struct
Customize the sendAndReceiveSASLAuth to handle the SCRAM workflow

Am I missing anything?

[everesio]

In general that's it. Additionally proxy/client.go sets the implementation, config/config.go validates the params. There is a SASL plugin mechanism I used for OAUTHBEARER but it doesn't have to be used for SCRAM. Just do what you think is reasonable ;-)

[everesio]

Thank you for your contribution!
I have just merged you PR and vendored xdg/scram.

[everesio]

release version v0.1.3