Skip to content

Add authentication credential callback support - #61

Open
emelialei88 wants to merge 26 commits into
bloomberg:mainfrom
emelialei88:authn/sdk
Open

Add authentication credential callback support#61
emelialei88 wants to merge 26 commits into
bloomberg:mainfrom
emelialei88:authn/sdk

Conversation

@emelialei88

@emelialei88 emelialei88 commented Dec 8, 2025

Copy link
Copy Markdown
Contributor

Summary

This PR adds support for authentication credential callbacks in the BlazingMQ Python SDK, enabling applications to provide dynamic authentication credentials when connecting to secured brokers.

New API Components

  • BasicAuthnCredentialCb - Python wrapper class that accepts a callable returning (mechanism: str, data: bytes) or None
  • FakeAuthnCredentialCb - Cython class that bridges Python callbacks to C++ authentication infrastructure
  • authn_credential_cb parameter added to Session.__init__() and Session.with_options()

Implementation Details

  • Integrated C++ authentication callback infrastructure with Python callable interface
  • Implemented proper GIL management for cross-language callback invocation
  • Added support for passing authentication credentials from Python to C++ BlazingMQ SDK
  • Exposed get_credential_data() method for C++ to invoke Python callbacks

Example Usage

import blazingmq

def main() -> None:
    session = blazingmq.Session(
        blazingmq.session_events.log_session_event,
        authn_credential_cb=lambda: ("BASIC", b"python:sdk")
    ...

@emelialei88
emelialei88 force-pushed the authn/sdk branch 2 times, most recently from c64c673 to 0663a77 Compare December 12, 2025 16:24
@emelialei88 emelialei88 changed the title provide a way to create credential Add authentication credential callback support Dec 12, 2025
@emelialei88
emelialei88 marked this pull request as ready for review December 12, 2025 16:45
@emelialei88
emelialei88 requested a review from a team December 12, 2025 16:45
@pniedzielski
pniedzielski self-requested a review December 12, 2025 17:28
@pniedzielski pniedzielski self-assigned this Dec 12, 2025
@pniedzielski
pniedzielski force-pushed the authn/sdk branch 4 times, most recently from 589d4f1 to 02041f7 Compare June 26, 2026 19:56
@pniedzielski
pniedzielski force-pushed the authn/sdk branch 3 times, most recently from 070d6be to dc5e839 Compare July 1, 2026 21:27
`SessionEventHandler` hand-rolls reference counting for its three
Python callbacks: three `Py_INCREF`s under a `GilAcquireGuard` in the
constructor, and three matching `Py_DECREF`s in the destructor.  As we
intend to add an additional callback to provide authentication
credentials, we will have to repeat this same structure wherever that
is held and make sure to get the GIL right.

This patch adds a new C++ class `pybmq::PyRef`, an owning reference
type that acquires the GIL whenever it adjusts a reference count.
Because copying and destroying it are GIL-safe, it can be held by
objects the SDK copies on its own IO threads.  By doing this, we no
longer need to manually maintain the reference count with `Py_INCREF`
and `Py_DECREF`s under the GIL.

This patch also ports the callbacks held by `SessionEventHandler` to
use it.  These changes do result in a few more locks and unlocks of
the GIL, but this only happens once while constructing and once while
destructing a `Session`, so the downside is small.

Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
This patch collapses two branches in `with_options`, which differed
only in whether `DEFAULT_TIMEOUT` or `session_options.timeouts` was
passed to a function call, and duplicated the other eleven.

Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
`with_options` passed eleven arguments positionally, so inserting a
parameter anywhere in `Session.__init__` would silently rebind every
argument after it rather than failing.  This patch changes the call to
pass all optional arguments by keyword.

Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
The constructor to `pybmq::Session` has been getting a little
unwieldy, growing to 21 parameters.  Originally, passing parameters
directly to `pybmq::Session` like this resulted in the simplest and
most transparent code in the Cython layer (which is the layer that is
hardest to debug) and meant we didn’t need to worry too much about the
reference counting of Python objects being marshalled through Cython.
But, with so many parameters now, this is more of a liability than a
benefit.

This patch adds a new struct `pybmq::SessionConfig`, which holds the
fourteen plain option values.  The Python callbacks, host health
monitor and exception types stay as constructor parameters, so no
Python object lives in the struct for reference counting ease.  Adding
this struct allows us to simplify the constructor for `pybmq::Session`
down from taking 21 arguments to taking only 8.

Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
@pniedzielski
pniedzielski requested a review from a team as a code owner September 4, 2026 19:01
@pniedzielski
pniedzielski force-pushed the authn/sdk branch 4 times, most recently from 5feb671 to 0f267de Compare September 4, 2026 20:08
pniedzielski and others added 3 commits September 4, 2026 16:15
CI failed to compile `pybmq_session.cpp`: `AuthnCredentialCbFunctor` is
called with no arguments, but `bmqt::SessionOptions::AuthnCredentialCb` at
the pinned `v0.95.14` is still

    bsl::function<bsl::optional<AuthnCredential>(bsl::ostream& error)>

The `ostream& error` parameter was removed upstream in
bloomberg/blazingmq@c161444 ("Refactor:
User authentication credentials callback (#1571)"), first released in
v0.95.15.  Our code was written against that signature, not the one the
pinned tag actually provides.

`bmqt_authncredential.h` (the `AuthnCredential` value type itself) is
unchanged between v0.95.14 and v0.95.20, and no other commit in that range
touches `SessionOptions`'s public surface except an internal allocator fix
(c0f272850), so nothing else in this branch needs to change for the bump.

Bump to v0.95.20, the latest tag, rather than the minimal v0.95.15, since
CMakeLists.txt is untouched across the whole range and BDE_TAG/NTF_CORE_TAG
need no corresponding change.
Signed-off-by: Emelia Lei <wlei29@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Right now, this defaults to `None` (i.e, no authentication).

Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Signed-off-by: Patrick M. Niedzielski <pniedzielski@bloomberg.net>
Remove the redundant `has_auth_callback` flag in favour of testing the
`bsl::function` directly, and bump copyright years on every file the
branch modifies.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants