[KIP-1139] Add support for OAuth jwt-bearer grant type #4978

anchitj · 2025-02-28T07:52:47Z

No description provided.

confluent-cla-assistant · 2025-02-28T07:52:57Z

🎉 All Contributor License Agreements have been signed. Ready to merge.
✅ anchitj
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

Copilot

Pull Request Overview

This PR introduces new JWT configuration options for OAuth-based authentication by adding several JWT-specific properties to the configuration documentation.

Added new JWT configuration properties including private key id, private key secret, token signing algorithm, token subject, token issuer, token audience, and token target audience.

Files not reviewed (6)

src/rdkafka.c: Language not supported
src/rdkafka_conf.c: Language not supported
src/rdkafka_conf.h: Language not supported
src/rdkafka_sasl_oauthbearer.c: Language not supported
src/rdkafka_sasl_oauthbearer_oidc.h: Language not supported
src/rdunittest.c: Language not supported

Copilot · 2025-03-19T10:11:46Z

CONFIGURATION.md

@@ -102,6 +102,13 @@ sasl.oauthbearer.client.secret           |  *  |                 |
 sasl.oauthbearer.scope                   |  *  |                 |               | low        | Client use this to specify the scope of the access request to the broker. Only used when `sasl.oauthbearer.method` is set to "oidc". <br>*Type: string*
 sasl.oauthbearer.extensions              |  *  |                 |               | low        | Allow additional information to be provided to the broker. Comma-separated list of key=value pairs. E.g., "supportFeatureX=true,organizationId=sales-emea".Only used when `sasl.oauthbearer.method` is set to "oidc". <br>*Type: string*
 sasl.oauthbearer.token.endpoint.url      |  *  |                 |               | low        | OAuth/OIDC issuer token endpoint HTTP(S) URI used to retrieve token. Only used when `sasl.oauthbearer.method` is set to "oidc". <br>*Type: string*
+sasl.oauthbearer.private.key.id          |  *  |                 |               | low        | Private key id. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*
+sasl.oauthbearer.private.key.secret      |  *  |                 |               | low        | Private key id. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*


The description for 'sasl.oauthbearer.private.key.secret' incorrectly repeats 'Private key id'. It should be updated to 'Private key secret' to accurately describe the configuration option.

Suggested change

sasl.oauthbearer.private.key.secret | * | | | low | Private key id. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*

sasl.oauthbearer.private.key.secret | * | | | low | Private key secret. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*

Copilot · 2025-03-19T10:11:46Z

CONFIGURATION.md

+sasl.oauthbearer.private.key.id          |  *  |                 |               | low        | Private key id. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*
+sasl.oauthbearer.private.key.secret      |  *  |                 |               | low        | Private key id. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*
+sasl.oauthbearer.token.signing.algorithm |  *  |                 |               | low        | token_signing_algorithm. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*
+sasl.oauthbearer.token.subject           |  *  |                 |               | low        | token_signing_algorithm. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*


The description for 'sasl.oauthbearer.token.subject' mistakenly uses 'token_signing_algorithm'. It should correctly describe the token subject instead.

Suggested change

sasl.oauthbearer.token.subject | * | | | low | token_signing_algorithm. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*

sasl.oauthbearer.token.subject | * | | | low | token_subject. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>*Type: string*

emasab

Thanks Anchit! Asking some changes to follow more closely the KIP.

emasab · 2025-05-28T08:57:26Z

src/rdkafka_sasl_oauthbearer.c

-            rk->rk_conf.sasl.oauthbearer.token_refresh_cb ==
-                rd_kafka_oidc_token_refresh_cb) {
+            (rk->rk_conf.sasl.oauthbearer.token_refresh_cb ==
+                 rd_kafka_jwt_refresh_cb ||


Here it's still a OIDC callback so it can be and the existing one renamed by adding client_credentials.

Suggested change

rd_kafka_jwt_refresh_cb ||

rd_kafka_oidc_token_jwt_bearer_refresh_cb ||

What do you mean? The callback methods are different so don't we need to check for both of them?

src/rdunittest.c

src/rdkafka_conf.h

src/rdkafka_conf.c

src/rdkafka_sasl_oauthbearer_oidc.c

src/rdkafka_conf.c

src/rdkafka_sasl_oauthbearer_oidc.c

…mplementation for directly reading `sasl.oauthbearer.assertion.file` without changes or otherwise reading `sasl.oauthbearer.assertion.jwt.template.file` and modifying it with other configuration properties.

milindl

Approved with minor feedback, thanks @anchitj and @emasab

milindl · 2025-06-25T04:53:23Z

src/rdkafka_sasl_oauthbearer_oidc.c

+                goto done;
+        }
+
+        jwt_token = rd_kafka_oidc_token_try_validate(json, "access_token", &sub,


Please add a comment here why we try validating with access_token first and then id_token afterwards if it fails.

…d_file_open.

milindl

Thanks for the update on the PR

…ent, it's later mandatory after parsing the sub in the response token

milindl

newest changes lgtm!

emasab

Approving too as I reviewed initially

emasab · 2025-06-30T15:16:04Z

Hi @anchitj could you sign the new CLA? Thank you again.

anchitj · 2025-06-30T18:35:48Z

Done @emasab

anchitj added 3 commits February 20, 2025 12:31

JWT OAuth POC

a838b31

Add config props and code refactored

6d5142b

Added config

6ebd036

Verified working with GCP

194b8bf

airlock-confluentinc bot force-pushed the dev_oauth_jwt branch from 2d22a3f to 42432e1 Compare March 7, 2025 08:46

anchitj added 2 commits March 10, 2025 17:28

Mark KID and Private key sensitive

7024844

Minor changes

e2dd7f7

anchitj marked this pull request as ready for review March 19, 2025 10:10

Copilot AI review requested due to automatic review settings March 19, 2025 10:10

anchitj requested a review from a team as a code owner March 19, 2025 10:10

anchitj changed the title ~~Dev oauth jwt~~ Support for JWT Oauth Mar 19, 2025

Copilot AI reviewed Mar 19, 2025

View reviewed changes

anchitj changed the title ~~Support for JWT Oauth~~ [WIP] Support for JWT Oauth Mar 19, 2025

Change to align with KIP

8f52f5e

airlock-confluentinc bot force-pushed the dev_oauth_jwt branch from c9b8cae to d81eb64 Compare April 2, 2025 07:52

Test changes to make tests pass with both default and oidc methods

5a06d38

emasab changed the title ~~[WIP] Support for JWT Oauth~~ [KIP-1139] Add support for OAuth jwt-bearer grant type May 28, 2025

emasab requested changes May 28, 2025

View reviewed changes

anchitj added 3 commits May 29, 2025 16:33

PR comments - #1

c33848b

PR comments 2

c7cce32

Style fix

0778245

airlock-confluentinc bot force-pushed the dev_oauth_jwt branch 3 times, most recently from c070f49 to 2237412 Compare June 3, 2025 05:35

Complete implementation by renaming some functions and changing the i…

4604847

…mplementation for directly reading `sasl.oauthbearer.assertion.file` without changes or otherwise reading `sasl.oauthbearer.assertion.jwt.template.file` and modifying it with other configuration properties.

airlock-confluentinc bot force-pushed the dev_oauth_jwt branch from 2237412 to 581b10d Compare June 23, 2025 09:50

Fix for regression on sasl.oauthbearer.method=default

9683282

milindl approved these changes Jun 25, 2025

View reviewed changes

Add rd_file_mkstemp with Windows support and rename rd_open_file to r…

2e0d465

…d_file_open.

emasab added 2 commits May 8, 2025 20:17

trivup 0.13.0: support for JWT bearer grant type

5b94647

Trivup tests for different JWT bearer cases

317f148

milindl approved these changes Jun 26, 2025

View reviewed changes

Refactor variation name function

9dafbb6

milindl approved these changes Jun 26, 2025

View reviewed changes

emasab added 3 commits June 26, 2025 16:52

Update trivup 0.13.0 after merging it

ba86b4e

Address comment

309b64f

While md_principal_name becomes optional when creating the SASL cli…

beda684

…ent, it's later mandatory after parsing the sub in the response token

milindl approved these changes Jun 27, 2025

View reviewed changes

emasab added 2 commits June 27, 2025 16:59

Allow to retry with id_token on access_token validation failure

a8d82e4

Changelog entry

3b3e408

airlock-confluentinc bot force-pushed the dev_oauth_jwt branch 2 times, most recently from ffeb194 to 3b3e408 Compare June 30, 2025 13:43

milindl approved these changes Jun 30, 2025

View reviewed changes

emasab approved these changes Jun 30, 2025

View reviewed changes

emasab closed this Jun 30, 2025

emasab reopened this Jun 30, 2025

emasab merged commit 606d0e4 into master Jul 1, 2025
2 checks passed

emasab deleted the dev_oauth_jwt branch July 1, 2025 10:15

This was referenced Jul 10, 2025

Add Support for OAuth JWT-Bearer Grant Type (aka Client Assertions) in librdkafka #5096

Closed

[trivup 0.13.0] support for JWT bearer grant type #5072

Closed

	sasl.oauthbearer.private.key.secret \| * \| \| \| low \| Private key id. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>Type: string
	sasl.oauthbearer.private.key.secret \| * \| \| \| low \| Private key secret. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>Type: string

	sasl.oauthbearer.token.subject \| * \| \| \| low \| token_signing_algorithm. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>Type: string
	sasl.oauthbearer.token.subject \| * \| \| \| low \| token_subject. Only used when `sasl.oauthbearer.method` is set to "jwt". <br>Type: string

	rd_kafka_jwt_refresh_cb \|\|
	rd_kafka_oidc_token_jwt_bearer_refresh_cb \|\|

[KIP-1139] Add support for OAuth jwt-bearer grant type #4978

[KIP-1139] Add support for OAuth jwt-bearer grant type #4978

Uh oh!

Conversation

anchitj commented Feb 28, 2025

Uh oh!

confluent-cla-assistant bot commented Feb 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Mar 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 19, 2025

Choose a reason for hiding this comment

Uh oh!

emasab left a comment

Choose a reason for hiding this comment

Uh oh!

emasab May 28, 2025

Choose a reason for hiding this comment

Uh oh!

anchitj Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

milindl left a comment

Choose a reason for hiding this comment

Uh oh!

milindl Jun 25, 2025

Choose a reason for hiding this comment

Uh oh!

milindl left a comment

Choose a reason for hiding this comment

Uh oh!

milindl left a comment

Choose a reason for hiding this comment

Uh oh!

emasab left a comment

Choose a reason for hiding this comment

Uh oh!

emasab commented Jun 30, 2025

Uh oh!

anchitj commented Jun 30, 2025

Uh oh!

Uh oh!

Uh oh!

confluent-cla-assistant bot commented Feb 28, 2025 •

edited

Loading