Kafka UI OAUTHBEARER broker settings

[xdeveloper]

Hi, Team!

I have couple of parameters but do not understand how to use them in Kafka UI.

"security.protocol" = "SASL_SSL"
"sasl.mechanism" = "OAUTHBEARER"
"sasl.oauthbearer.token.endpoint.url" = "https://blablabla.oktapreview.com/oauth2/ausud5wgoxiBdIXXX0h7/v1/token"
"sasl.login.callback.handler.class" = "org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler"
"sasl.jaas.config" = "org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required clientId="client_id" clientSecret="client_secret" scope="user";"

How to do that using UI or by editing some conf files?

Please help!

[Haarolean]

You can use our UI setup wizard (docs link, where you can choose your auth method (oauthbearer included)

[xdeveloper]

@Haarolean no idea how to put my parameters into Wizard.

[xdeveloper]

[xdeveloper]

I have: sasl.oauthbearer.token.endpoint.url, sasl.login.callback.handler.class, sasl.jaas.config

[Haarolean]

https://kafka.apache.org/20/javadoc/org/apache/kafka/common/security/oauthbearer/OAuthBearerLoginModule.html

Here is a typical, basic JAAS configuration for a client leveraging unsecured SASL/OAUTHBEARER authentication:

 KafkaClient {
      org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule Required
      unsecuredLoginStringClaim_sub="thePrincipalName";
 };

[xdeveloper]

Is there any chance to use OAUTH for Schema Registry?

[Haarolean]

I doubt SR supports OAuth. How are you supposed to authenticate as a consumer/producer in this case?

[xdeveloper]

I use bearer.auth.credentials.source: "SASL_OAUTHBEARER_INHERIT" for Schema Registry configuration. I inherits auth data from kafka client (do not know how but it works on real project) чт, 1 серп. 2024 р. о 20:22 Roman Zabaluev ***@***.***> пише:

…

I doubt SR supports OAuth. How are you supposed to authenticate as a consumer/producer in this case? — Reply to this email directly, view it on GitHub <#433 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHRMKCKGUII3Q2XLW2NKJ3ZPJVETAVCNFSM6AAAAABIYVOR3OVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMRRGUYDSNQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>