Kafka UI OAUTHBEARER broker settings

[xdeveloper]

Hi, Team!

I have couple of parameters but do not understand how to use them in Kafka UI.

"security.protocol" = "SASL_SSL"
"sasl.mechanism" = "OAUTHBEARER"
"sasl.oauthbearer.token.endpoint.url" = "https://blablabla.oktapreview.com/oauth2/ausud5wgoxiBdIXXX0h7/v1/token"
"sasl.login.callback.handler.class" = "org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler"
"sasl.jaas.config" = "org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required clientId="client_id" clientSecret="client_secret" scope="user";"

How to do that using UI or by editing some conf files?

Please help!

[Haarolean]

You can use our UI setup wizard (docs link, where you can choose your auth method (oauthbearer included)

[xdeveloper]

@Haarolean no idea how to put my parameters into Wizard.

[xdeveloper]

[xdeveloper]

I have: sasl.oauthbearer.token.endpoint.url, sasl.login.callback.handler.class, sasl.jaas.config

[Haarolean]

https://kafka.apache.org/20/javadoc/org/apache/kafka/common/security/oauthbearer/OAuthBearerLoginModule.html

Here is a typical, basic JAAS configuration for a client leveraging unsecured SASL/OAUTHBEARER authentication:

 KafkaClient {
      org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule Required
      unsecuredLoginStringClaim_sub="thePrincipalName";
 };

[xdeveloper]

Is there any chance to use OAUTH for Schema Registry?

[Haarolean]

I doubt SR supports OAuth. How are you supposed to authenticate as a consumer/producer in this case?

[xdeveloper]

I use bearer.auth.credentials.source: "SASL_OAUTHBEARER_INHERIT" for Schema Registry configuration. I inherits auth data from kafka client (do not know how but it works on real project) чт, 1 серп. 2024 р. о 20:22 Roman Zabaluev ***@***.***> пише:

…

I doubt SR supports OAuth. How are you supposed to authenticate as a consumer/producer in this case? — Reply to this email directly, view it on GitHub <#433 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHRMKCKGUII3Q2XLW2NKJ3ZPJVETAVCNFSM6AAAAABIYVOR3OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMRRGUYDSNQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[Li-Dongmeng]

I have encountered the same problem now. How did you solve it at that time. Please provide a more detailed method

[MariaIRubio]

Hi! I am having problems to configure my broker in the UI with SASL_SSL y OAUTHBEARER mechanism.
How should the sasl.jaas.config be?

Something like this?

org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required  oauth.client.id="clientid" oauth.client.secret="clientsecret" oauth.token.endpoint.uri="issuer/auth/realms/realm/protocol/openid-connect/token"; sasl.oauthbearer.sub.claim.name="preferred_username"; sasl.client.callback.handler.class="io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler";

like this?

KafkaClient {
	org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule Required 
	usecuredLoginStringClaim_sub="preferred_name";
};

like this?

KafkaClient{
org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required  
oauth.client.id="clientid" 
oauth.client.secret="clientsecret" 
oauth.token.endpoint.uri="issuer/auth/realms/realm/protocol/openid-connect/token";
sasl.oauthbearer.sub.claim.name="preferred_username"; 
sasl.client.callback.handler.class="io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler";
};

something totally different?

Thank you very much in advance

[Haarolean]

#857 (comment)