Fix for `"this.authorizerMetrics" is null` issue in Kafka 4.1.0 #283

mstruk · 2025-10-22T18:42:14Z

This PR fixes the issue when using KeycloakAuthorizer in Kafka 4.1.0 when delegation to StandardAuthorizer is enabled (strimzi.authorization.delegate.to.kafka.acl=true).

Whenever the authorization decision is delegated to StandardAuthorizer the following exception happens:

java.lang.NullPointerException: Cannot invoke "org.apache.kafka.metadata.authorizer.StandardAuthorizer$AuthorizerMetrics.recordAuthorizerMetrics(org.apache.kafka.server.authorizer.AuthorizationResult)" because "this.authorizerMetrics" is null
	at org.apache.kafka.metadata.authorizer.StandardAuthorizer.authorize(StandardAuthorizer.java:153) ~[kafka-metadata-4.1.0.jar:?]
	at io.strimzi.kafka.oauth.server.authorizer.KeycloakRBACAuthorizer.delegateIfRequested(KeycloakRBACAuthorizer.java:469) ~[kafka-oauth-keycloak-authorizer-0.17.0.jar:?]
	at io.strimzi.kafka.oauth.server.authorizer.KeycloakRBACAuthorizer.authorize(KeycloakRBACAuthorizer.java:340) ~[kafka-oauth-keycloak-authorizer-0.17.0.jar:?]
	at io.strimzi.kafka.oauth.server.authorizer.KeycloakAuthorizer.authorize(KeycloakAuthorizer.java:227) ~[kafka-oauth-keycloak-authorizer-0.17.0.jar:?]
...

Kafka 4.1.0 added new metrics pluggability mechanism and updated StandardAuthorizer to implement Monitorable interface and expect a PluginMetrics object to be provided by instantiating server via Monitorable.withPluginMetrics(PluginMetrics pluginMetrics).

For KeycloakAuthorizer to be deployable to Kafka 4.0.0 where Monitorable interface is not present, and to also properly work on Kafka 4.1.0 where Monitorable.withPluginMetrics() is expected to be called on StandardAuthorizer the only way to address this without having multiple versions of KeycloakAuthorizer is to use reflection.

It is not possible for KeycloakAuthorizer to implement Monitorable and still be compatible with Kafka 4.0.0, thus the PluginMetrics instance that we set on StandardAuthorizer when running in Kafka 4.1.0 is not passed in and backed by the Metrics object of BrokerServer or ControllerServer but by a separate internally managed Metrics object used by all the Strimzi OAuth pluggable classes.

mimaison

Thanks for the PR, I left a few comments.

How much effort would it take to stop using non-public Kafka APIs?

mimaison · 2025-10-23T14:23:45Z

...ak-authorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/KeycloakAuthorizer.java

+    private void initPluginMetricsIfNeeded() {
+        Class<?> monitorableClass = null;
+        try {
+            // Check if StandardAuthorizer implements Monitorable, which can only be true if running on Kafka 4.1.0+


The comment is a bit misleading. This block checks if the Monitorable class is present, ie, we're running >=4.1

Do you have a suggestion how to rephrase?

What about // Check if Monitorable is present. This indicates if we're running on Kafka 4.1.0+?

mimaison · 2025-10-23T14:26:23Z

...ak-authorizer/src/main/java/io/strimzi/kafka/oauth/server/authorizer/KeycloakAuthorizer.java

+                pluginMetrics = method.invoke(null, delegate, metrics, "authorizer.class.name", "role", determineRole());
+            }
+        } catch (Throwable e) {
+            log.warn("Failed to initialise PluginMetrics on StandardAuthorizer", e);


Isn't it fatal if we reach this point?

Yes, it will fail later during StandardAuthorizer.authorize() calls with 'this.authorizerMetrics is null' rather than at bootup in KeycloakAuthorizer.configure(). It a choice here whether to fail fast at boot or later on. I can change it to fail fast.

I don't know the project enough to advise where it's best to fail. In theory failing fast is often preferred but obviously it depends, I trust you to make the right call. But if it's fatal, maybe log it as fatal or error rather than warn?

Modified so it fails fast.

testsuite/docker/hydra-import/scripts/start.sh

mstruk · 2025-10-23T15:03:50Z

How much effort would it take to stop using non-public Kafka APIs?

Can you be more specific here? We wrap StandardAuthorizer and take control of its lifecycle. StandardAuthorizer is not considered public API based on its package. But we need a way to delegate to it and control its lifecycle. So what are even the options?

mimaison · 2025-10-23T15:29:25Z

Can you be more specific here? We wrap StandardAuthorizer and take control of its lifecycle. StandardAuthorizer is not considered public API based on its package. But we need a way to delegate to it and control its lifecycle. So what are even the options?

I don't know enough about this component to tell. We can discuss this after this is resolved.

…horizer using reflection Signed-off-by: Marko Strukelj <[email protected]>

Signed-off-by: Marko Strukelj <[email protected]>

mimaison

LGTM

scholzj

Thanks @mstruk

…mzi#283) Signed-off-by: Marko Strukelj <[email protected]>

StevenJDH · 2025-11-06T13:17:31Z

@mstruk and @mimaison is there a workaround for this? I'm currently using Strimzi 0.48.0 and Kakfa 4.1.0 which doesn't have yet this fix included.

mstruk · 2025-11-06T18:33:13Z

Until Strimzi 0.49.0 is released what you can do is make your own Kafka 4.1.0 image based on 0.48.0 and replace in the libs directory thekafka-oauth-*-0.17.0.jar files with kafka-oauth-*-0.17.1.jar files.
You really only need to replace kafka-oauth-common and kafka-oauth-keycloak-authorizer.

mstruk requested a review from mimaison October 22, 2025 18:43

mstruk added this to the 0.17.1 milestone Oct 23, 2025

mimaison reviewed Oct 23, 2025

View reviewed changes

mstruk requested a review from mimaison October 23, 2025 15:04

mstruk added 3 commits October 24, 2025 12:12

Fix '"this.authorizerMetrics" is null' when delegating to StandardAut…

fbbf7f1

…horizer using reflection Signed-off-by: Marko Strukelj <[email protected]>

Address spotbugs:check

318672c

Signed-off-by: Marko Strukelj <[email protected]>

Make reflection failure on 4.1.0+ fail-fast

f194b97

Signed-off-by: Marko Strukelj <[email protected]>

mstruk force-pushed the fix-for-kafka-4.1.0 branch from 1bca209 to f194b97 Compare October 24, 2025 10:36

mimaison approved these changes Oct 24, 2025

View reviewed changes

mstruk requested a review from scholzj October 24, 2025 11:41

scholzj approved these changes Oct 24, 2025

View reviewed changes

mstruk merged commit ed1f658 into strimzi:main Oct 24, 2025
6 checks passed

mstruk added a commit to mstruk/strimzi-kafka-oauth that referenced this pull request Oct 28, 2025

Fix for "this.authorizerMetrics" is null issue in Kafka 4.1.0 (stri…

1436d50

…mzi#283) Signed-off-by: Marko Strukelj <[email protected]>

Fix for "this.authorizerMetrics" is null issue in Kafka 4.1.0 #283

Fix for "this.authorizerMetrics" is null issue in Kafka 4.1.0 #283

Uh oh!

Conversation

mstruk commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mimaison left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mstruk commented Oct 23, 2025

Uh oh!

mimaison commented Oct 23, 2025

Uh oh!

mimaison left a comment

Choose a reason for hiding this comment

Uh oh!

scholzj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

StevenJDH commented Nov 6, 2025

Uh oh!

mstruk commented Nov 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Fix for `"this.authorizerMetrics" is null` issue in Kafka 4.1.0 #283

Fix for `"this.authorizerMetrics" is null` issue in Kafka 4.1.0 #283

mstruk commented Oct 22, 2025 •

edited

Loading