Skip to content

Add authentication credential callback support - #61

Open
emelialei88 wants to merge 2 commits into
bloomberg:mainfrom
emelialei88:authn/sdk
Open

emelialei88 wants to merge 2 commits into
bloomberg:mainfrom
emelialei88:authn/sdk

Conversation

@emelialei88

@emelialei88 emelialei88 commented Dec 8, 2025 •

Copy link
Copy Markdown
Contributor

Summary

This PR adds support for authentication credential callbacks in the BlazingMQ Python SDK, enabling applications to provide dynamic authentication credentials when connecting to secured brokers.

New API Components

  • BasicAuthnCredentialCb - Python wrapper class that accepts a callable returning (mechanism: str, data: bytes) or None
  • FakeAuthnCredentialCb - Cython class that bridges Python callbacks to C++ authentication infrastructure
  • authn_credential_cb parameter added to Session.__init__() and Session.with_options()

Implementation Details

  • Integrated C++ authentication callback infrastructure with Python callable interface
  • Implemented proper GIL management for cross-language callback invocation
  • Added support for passing authentication credentials from Python to C++ BlazingMQ SDK
  • Exposed get_credential_data() method for C++ to invoke Python callbacks

Example Usage

import blazingmq

def main() -> None:
    session = blazingmq.Session(
        blazingmq.session_events.log_session_event,
        authn_credential_cb=lambda: ("BASIC", b"python:sdk")
    ...

@emelialei88
emelialei88 force-pushed the authn/sdk branch 2 times, most recently from c64c673 to 0663a77 Compare December 12, 2025 16:24
@emelialei88 emelialei88 changed the title provide a way to create credential Add authentication credential callback support Dec 12, 2025
@emelialei88
emelialei88 marked this pull request as ready for review December 12, 2025 16:45
@emelialei88
emelialei88 requested a review from a team December 12, 2025 16:45
@pniedzielski
pniedzielski self-requested a review December 12, 2025 17:28
@pniedzielski pniedzielski self-assigned this Dec 12, 2025
@pniedzielski
pniedzielski force-pushed the authn/sdk branch 4 times, most recently from 589d4f1 to 02041f7 Compare June 26, 2026 19:56
@pniedzielski
pniedzielski force-pushed the authn/sdk branch 3 times, most recently from 070d6be to dc5e839 Compare July 1, 2026 21:27
@pniedzielski
pniedzielski force-pushed the authn/sdk branch 2 times, most recently from 2da9d8d to 55ce501 Compare September 4, 2026 19:00
@pniedzielski
pniedzielski requested a review from a team as a code owner September 4, 2026 19:01
@pniedzielski
pniedzielski force-pushed the authn/sdk branch 5 times, most recently from 0f267de to 909a8d4 Compare September 4, 2026 20:16
arnaudmorin pushed a commit to arnaudmorin/blazingmq-sdk-python that referenced this pull request Oct 22, 2026
- Build against arnaudmorin/blazingmq@ee5a2b7c, which initializes the
  TLS flag of the connect options: it was random, and plain connections
  aborted on an assertion when they were seen as TLS.
- The authentication tests of bloomberg#61 did not expect the user_agent_prefix
  argument and failed.

Signed-off-by: Arnaud M. <arnaud.choupinette@mailops.fr>
Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>
@pniedzielski pniedzielski linked an issue Oct 26, 2026 that may be closed by this pull request
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
This patch adds an optional `authn_credential_provider` argument to
`Session` and `SessionOptions`.  It is a callable returning a
`(mechanism, data)` tuple of `(str, bytes)`, called each time the
session authenticates with the broker, including on reauthentication.
If it returns `None` or raises, the connection is closed: starting a
session fails, while an already-started session sees `ConnectionLost`
and then reconnects, calling the provider again.  If no provider is
given, no credentials are sent, as before.

The provider is then wrapped in a Cython `AuthnCredentialCbAdapter` as a
translation layer between the pure Python callable and the C++
`bmqt::SessionOptions::AuthnCredentialCb`.  From there, the C++ SDK
takes over all authentication work.

Signed-off-by: Emelia Lei <wlei29@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>

@678098 678098 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, just a few comments

Comment thread src/blazingmq/_ext.pyx
if result is None:
return None

mechanism, data = result

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If result doesn't unpack to 2 args, the ValueError will be triggered here.
I think it is okay.
The only question: do we want to have both ValueError/TypeError here?

result = adapter.get_credential_data()

# THEN
assert result == (b"PLAIN\x00extra", b"data")

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might log mechanism on the broker.
Not sure if we want to allow every possible character there
https://github.com/bloomberg/blazingmq/pull/1776/changes

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support authentication

3 participants