Admin-API: URL Parameters must be unescaped

[weeco]

Version & Environment

Redpanda version: (use rpk version): v23.2.6

What went wrong?

Deleting a Redpanda user that uses special characters that need to be URL escaped is not possible, because the admin API does not unescape these parameters. Creating is possible because the username there is part of the request body.

What should have happened instead?

Redpanda should unescape URL parameters on all admin api paths.

How to reproduce the issue?

1. Create a user like "hello world"
2. Issue a DELETE request to /v1/security/users/hello%20world
3. List users (the user "hello world" should still be there)

Additional information

Please attach any relevant logs, backtraces, or metric charts.

[michael-redpanda]

1. https://github.com/redpanda-data/redpanda/blob/cba5d0794946755beb4a8bce419bc8b84a1318f2/src/v/redpanda/admin_server.cc#L1935C4-L1935C4 needs to be modified to correctly parse the HTTP escape characters to get the "true" value. Seastar has a utility for this
2. Create user path needs to check the kafka regex to ensure created users comply with this regex
3. Delete user path should not check this value and permit the special characters so operators can delete credentials that fall outside this regex

[oleiman]

kafka regex

@michael-redpanda Is this specified somewhere? I've not found anything explicit in kafka (yet). Am I missing something obvious?

[michael-redpanda]

kafka regex

@michael-redpanda Is this specified somewhere? I've not found anything explicit in kafka (yet). Am I missing something obvious?

redpanda/src/v/security/scram_algorithm.cc

Lines 41 to 43 in 53f12fe

	// 1*(value-safe-char / "=2C" / "=3D")
	// NOLINTNEXTLINE
	#define SASLNAME "(?:" VALUE_SAFE_CHAR "|=2C|=3D)+"