muralibasani commented on code in PR #23397:
URL: https://github.com/apache/kafka/pull/23397#discussion_r3965342711
##########
docker/native/native-image-configs/reflect-config.json:
##########
@@ -1040,6 +1040,30 @@
{
"name":"org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator"
},
+{
+ "name":"org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule",
Review Comment:
Yes, and also had to update entries for DefaultJwtRetriever and
DefaultJwtValidator.
Tested the native image with Entra idp, oidc flow.
```
export
KAFKA_OPTS="-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls=https://login.microsoftonline.com/2f30bfc2-b299-459b-ae49-06caa4f4e3f5/oauth2/v2.0/token";
muralidhar.basani@Muralidhars-MacBook-Pro oauthbearer-secured %
$KAFKA/bin/kafka-topics.sh --bootstrap-server localhost:9094 --command-config
client.properties \
--create --topic oidc-native --partitions 1 --replication-factor 1
Created topic oidc-native.
muralidhar.basani@Muralidhars-MacBook-Pro oauthbearer-secured % echo
"hello-oidc-native" | $KAFKA/bin/kafka-console-producer.sh --bootstrap-server
localhost:9094 \
--command-config client.properties --topic oidc-native
muralidhar.basani@Muralidhars-MacBook-Pro oauthbearer-secured %
$KAFKA/bin/kafka-console-consumer.sh --bootstrap-server localhost:9094 \
--command-config client.properties --topic oidc-native --from-beginning
--max-messages 1
The consumer rebalance protocol (KIP-848) is production-ready! Set
group.protocol=consumer to try it out. See
https://kafka.apache.org/documentation/#consumer_rebalance_protocol
hello-oidc-native
Processed a total of 1 messages
```
```
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP:
'CONTROLLER:PLAINTEXT,INTERNAL:PLAINTEXT,OAUTH:SASL_PLAINTEXT'
KAFKA_LISTENERS: 'CONTROLLER://:29093,INTERNAL://:19092,OAUTH://:9094'
KAFKA_ADVERTISED_LISTENERS:
'INTERNAL://broker:19092,OAUTH://localhost:9094'
KAFKA_SASL_ENABLED_MECHANISMS: 'OAUTHBEARER'
KAFKA_LISTENER_NAME_OAUTH_SASL_ENABLED_MECHANISMS: 'OAUTHBEARER'
KAFKA_LISTENER_NAME_OAUTH_OAUTHBEARER_SASL_SERVER_CALLBACK_HANDLER_CLASS:
'org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler'
KAFKA_LISTENER_NAME_OAUTH_OAUTHBEARER_SASL_JAAS_CONFIG:
'org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;'
KAFKA_LISTENER_NAME_OAUTH_OAUTHBEARER_SASL_OAUTHBEARER_JWKS_ENDPOINT_URL:
'https://login.microsoftonline.com/2f30bfc2-b299-459b-ae49-06caa4f4e3f5/discovery/v2.0/keys'
KAFKA_LISTENER_NAME_OAUTH_OAUTHBEARER_SASL_OAUTHBEARER_EXPECTED_ISSUER:
'https://login.microsoftonline.com/2f30bfc2-b299-459b-ae49-06caa4f4e3f5/v2.0'
KAFKA_LISTENER_NAME_OAUTH_OAUTHBEARER_SASL_OAUTHBEARER_EXPECTED_AUDIENCE:
'590e8712-dae9-499a-a4d9-81ca85ca708e'
# Allow-list the JWKS URL the broker fetches (anti-SSRF control)
KAFKA_OPTS:
'-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls=https://login.microsoftonline.com/2f30bfc2-b299-459b-ae49-06caa4f4e3f5/discovery/v2.0/keys'
```
```
cat client.properties
# Secured OAUTHBEARER (OIDC / Entra ID) client — client-credentials grant.
bootstrap.servers=localhost:9094
security.protocol=SASL_PLAINTEXT
sasl.mechanism=OAUTHBEARER
sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginCallbackHandler
sasl.oauthbearer.token.endpoint.url=https://login.microsoftonline.com/2f30bfc2-b299-459b-ae49-06caa4f4e3f5/oauth2/v2.0/token
sasl.oauthbearer.scope=590e8712-..../.default
sasl.oauthbearer.client.credentials.client.id=.....client id
sasl.oauthbearer.client.credentials.client.secret=......secret
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule
required;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
