Repository: apache/kafka
File: clients/src/main/java/org/apache/kafka/common/security/JaasContext.java (Java)

Code before:
        String disallowedProperty = System.getProperty(DISALLOWED_LOGIN_MODULES_CONFIG);
        if (disallowedProperty != null) {
            LOG.warn("System property '{}' is deprecated and will be removed in a future release. Use '{}' instead.",
                    DISALLOWED_LOGIN_MODULES_CONFIG, ALLOWED_LOGIN_MODULES_CONFIG);
        }
        String loginModuleName = appConfigurationEntry.getLoginModuleName().trim();
        String allowedProperty = System.getProperty(ALLOWED_LOGIN_MODULES_CONFIG);
        if (allowedProperty != null) {
            Set<String> allowedLoginModuleList = Arrays.stream(allowedProperty.split(","))
                    .map(String::trim)
                    .collect(Collectors.toSet());
            if (!allowedLoginModuleList.contains(loginModuleName)) {
                throw new IllegalArgumentException(loginModuleName + " is not allowed. Update System property '"
                        + ALLOWED_LOGIN_MODULES_CONFIG + "' to allow " + loginModuleName);
            }
            return;
        }
        if (disallowedProperty == null) {
            disallowedProperty = DISALLOWED_LOGIN_MODULES_DEFAULT;
        }
        Set<String> disallowedLoginModuleList = Arrays.stream(disallowedProperty.split(","))
                .map(String::trim)
                .collect(Collectors.toSet());
        if (disallowedLoginModuleList.contains(loginModuleName)) {
            throw new IllegalArgumentException(loginModuleName + " is not allowed. Update System property '"
                    + DISALLOWED_LOGIN_MODULES_CONFIG + "' to allow " + loginModuleName);
        }
    }

    private static JaasContext defaultContext(JaasContext.Type contextType, String listenerContextName,
                                              String globalContextName) {
        String jaasConfigFile = System.getProperty(JaasUtils.JAVA_LOGIN_CONFIG_PARAM);
        if (jaasConfigFile == null) {
            if (contextType == Type.CLIENT) {
                LOG.debug("System property '" + JaasUtils.JAVA_LOGIN_CONFIG_PARAM + "' and Kafka SASL property '" +
                        SaslConfigs.SASL_JAAS_CONFIG + "' are not set, using default JAAS configuration.");
            } else {
                LOG.debug("System property '" + JaasUtils.JAVA_LOGIN_CONFIG_PARAM + "' is not set, using default JAAS " +
                        "configuration.");
            }
        }

        Configuration jaasConfig = Configuration.getConfiguration();

        AppConfigurationEntry[] configEntries = null;
        String contextName = globalContextName;

        if (listenerContextName != null) {
            configEntries = jaasConfig.getAppConfigurationEntry(listenerContextName);
            if (configEntries != null)
                contextName = listenerContextName;

Review comment (suggestion):
nit: We should also add the deprecation message in this error message to tell users to change to allowList instead.

Code after:
     static void throwIfLoginModuleIsNotAllowed(AppConfigurationEntry appConfigurationEntry) {
        String disallowedProperty = System.getProperty(DISALLOWED_LOGIN_MODULES_CONFIG);
        if (disallowedProperty != null) {
            LOG.warn("System property '{}' is deprecated and will be removed in a future release. Use '{}' instead.",
                    DISALLOWED_LOGIN_MODULES_CONFIG, ALLOWED_LOGIN_MODULES_CONFIG);
        }
        String loginModuleName = appConfigurationEntry.getLoginModuleName().trim();
        String allowedProperty = System.getProperty(ALLOWED_LOGIN_MODULES_CONFIG);
        if (allowedProperty != null) {
            Set<String> allowedLoginModuleList = Arrays.stream(allowedProperty.split(","))
                    .map(String::trim)
                    .collect(Collectors.toSet());
            if (!allowedLoginModuleList.contains(loginModuleName)) {
                throw new IllegalArgumentException(loginModuleName + " is not allowed. Update System property '"
                        + ALLOWED_LOGIN_MODULES_CONFIG + "' to allow " + loginModuleName);
            }
            return;
        }
        if (disallowedProperty == null) {
            disallowedProperty = DISALLOWED_LOGIN_MODULES_DEFAULT;
        }
        Set<String> disallowedLoginModuleList = Arrays.stream(disallowedProperty.split(","))
                .map(String::trim)
                .collect(Collectors.toSet());
        if (disallowedLoginModuleList.contains(loginModuleName)) {
            throw new IllegalArgumentException(loginModuleName + " is not allowed. "
                + "The system property '" + DISALLOWED_LOGIN_MODULES_CONFIG + "' is deprecated. "
                + "Use the " + ALLOWED_LOGIN_MODULES_CONFIG + " to allow this module. e.g.,"
                + "-D" + ALLOWED_LOGIN_MODULES_CONFIG + "=" + loginModuleName);
        }
    }

    private static JaasContext defaultContext(JaasContext.Type contextType, String listenerContextName,
                                              String globalContextName) {
        String jaasConfigFile = System.getProperty(JaasUtils.JAVA_LOGIN_CONFIG_PARAM);
        if (jaasConfigFile == null) {
            if (contextType == Type.CLIENT) {
                LOG.debug("System property '" + JaasUtils.JAVA_LOGIN_CONFIG_PARAM + "' and Kafka SASL property '" +
                        SaslConfigs.SASL_JAAS_CONFIG + "' are not set, using default JAAS configuration.");
            } else {
                LOG.debug("System property '" + JaasUtils.JAVA_LOGIN_CONFIG_PARAM + "' is not set, using default JAAS " +
                        "configuration.");
            }
        }

        Configuration jaasConfig = Configuration.getConfiguration();

        AppConfigurationEntry[] configEntries = null;
        String contextName = globalContextName;

        if (listenerContextName != null) {