Add authentication credential callback support - #61
Open
emelialei88 wants to merge 26 commits into
Open
Conversation
emelialei88
force-pushed
the
authn/sdk
branch
2 times, most recently
from
December 12, 2025 16:24
c64c673 to
0663a77
Compare
emelialei88
force-pushed
the
authn/sdk
branch
from
December 12, 2025 16:35
0663a77 to
70c3f88
Compare
emelialei88
marked this pull request as ready for review
December 12, 2025 16:45
pniedzielski
self-requested a review
December 12, 2025 17:28
emelialei88
force-pushed
the
authn/sdk
branch
from
December 12, 2025 17:48
70c3f88 to
1c01ff0
Compare
pniedzielski
force-pushed
the
authn/sdk
branch
4 times, most recently
from
June 26, 2026 19:56
589d4f1 to
02041f7
Compare
pniedzielski
force-pushed
the
authn/sdk
branch
3 times, most recently
from
July 1, 2026 21:27
070d6be to
dc5e839
Compare
pniedzielski
force-pushed
the
authn/sdk
branch
from
August 31, 2026 20:18
dc5e839 to
2da9d8d
Compare
`SessionEventHandler` hand-rolls reference counting for its three Python callbacks: three `Py_INCREF`s under a `GilAcquireGuard` in the constructor, and three matching `Py_DECREF`s in the destructor. As we intend to add an additional callback to provide authentication credentials, we will have to repeat this same structure wherever that is held and make sure to get the GIL right. This patch adds a new C++ class `pybmq::PyRef`, an owning reference type that acquires the GIL whenever it adjusts a reference count. Because copying and destroying it are GIL-safe, it can be held by objects the SDK copies on its own IO threads. By doing this, we no longer need to manually maintain the reference count with `Py_INCREF` and `Py_DECREF`s under the GIL. This patch also ports the callbacks held by `SessionEventHandler` to use it. These changes do result in a few more locks and unlocks of the GIL, but this only happens once while constructing and once while destructing a `Session`, so the downside is small. Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
This patch collapses two branches in `with_options`, which differed only in whether `DEFAULT_TIMEOUT` or `session_options.timeouts` was passed to a function call, and duplicated the other eleven. Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
`with_options` passed eleven arguments positionally, so inserting a parameter anywhere in `Session.__init__` would silently rebind every argument after it rather than failing. This patch changes the call to pass all optional arguments by keyword. Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
The constructor to `pybmq::Session` has been getting a little unwieldy, growing to 21 parameters. Originally, passing parameters directly to `pybmq::Session` like this resulted in the simplest and most transparent code in the Cython layer (which is the layer that is hardest to debug) and meant we didn’t need to worry too much about the reference counting of Python objects being marshalled through Cython. But, with so many parameters now, this is more of a liability than a benefit. This patch adds a new struct `pybmq::SessionConfig`, which holds the fourteen plain option values. The Python callbacks, host health monitor and exception types stay as constructor parameters, so no Python object lives in the struct for reference counting ease. Adding this struct allows us to simplify the constructor for `pybmq::Session` down from taking 21 arguments to taking only 8. Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
pniedzielski
force-pushed
the
authn/sdk
branch
from
September 4, 2026 19:00
2da9d8d to
55ce501
Compare
pniedzielski
force-pushed
the
authn/sdk
branch
4 times, most recently
from
September 4, 2026 20:08
5feb671 to
0f267de
Compare
CI failed to compile `pybmq_session.cpp`: `AuthnCredentialCbFunctor` is
called with no arguments, but `bmqt::SessionOptions::AuthnCredentialCb` at
the pinned `v0.95.14` is still
bsl::function<bsl::optional<AuthnCredential>(bsl::ostream& error)>
The `ostream& error` parameter was removed upstream in
bloomberg/blazingmq@c161444 ("Refactor:
User authentication credentials callback (#1571)"), first released in
v0.95.15. Our code was written against that signature, not the one the
pinned tag actually provides.
`bmqt_authncredential.h` (the `AuthnCredential` value type itself) is
unchanged between v0.95.14 and v0.95.20, and no other commit in that range
touches `SessionOptions`'s public surface except an internal allocator fix
(c0f272850), so nothing else in this branch needs to change for the bump.
Bump to v0.95.20, the latest tag, rather than the minimal v0.95.15, since
CMakeLists.txt is untouched across the whole range and BDE_TAG/NTF_CORE_TAG
need no corresponding change.
Signed-off-by: Emelia Lei <wlei29@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Right now, this defaults to `None` (i.e, no authentication). Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Remove the redundant `has_auth_callback` flag in favour of testing the `bsl::function` directly, and bump copyright years on every file the branch modifies.
pniedzielski
force-pushed
the
authn/sdk
branch
from
September 4, 2026 20:16
0f267de to
909a8d4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds support for authentication credential callbacks in the BlazingMQ Python SDK, enabling applications to provide dynamic authentication credentials when connecting to secured brokers.
New API Components
BasicAuthnCredentialCb- Python wrapper class that accepts a callable returning (mechanism: str, data: bytes) or NoneFakeAuthnCredentialCb- Cython class that bridges Python callbacks to C++ authentication infrastructureauthn_credential_cbparameter added toSession.__init__()andSession.with_options()Implementation Details
get_credential_data()method for C++ to invoke Python callbacksExample Usage