Configuring OAUTHBEARER authentication in the UI

[lutin7812]

Hi, is there's a way in the UI web page to configure the "sasl.jaas.config" in the case of an OIDC protocol?

Our config-confluent property file look like this:

sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
    clientId='xxxx' \
    scope='api://xxxx/.default' \
    clientSecret='xxxx' \
    extension_logicalCluster='xxxx' \
    extension_identityPoolId='xxxx';

Thank's for help.
Olivier

[mazilu88]

I also am trying to configure this, I have configured strimzi kafka with

    - name: plain
      port: 9092
      type: internal
      tls: false
      authentication:
        type: oauth
        validIssuerUri: https://xxxx/auth/realms/kafka-authz
        jwksEndpointUri: https://xxxx/auth/realms/kafka-authz/protocol/openid-connect/certs
        userNameClaim: preferred_username
        checkAccessTokenType: false
        customClaimCheck: "@.typ && @.typ == 'Bearer'"

        # the next option is only available since Strimzi 0.20.0
        # remove it if using an older version of Strimzi
        maxSecondsWithoutReauthentication: 3600

The config we use with spring and can communicate with Kafka is this

security.protocol=SASL_PLAINTEXT
sasl.mechanism=OAUTHBEARER
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
  oauth.client.id="xxxx" \
  oauth.client.secret="xxxx" \
  oauth.token.endpoint.uri="https://KC/auth/realms/kafka-authz/protocol/openid-connect/token" ;
sasl.login.callback.handler.class=io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler

I tried the same with kafka-ui but with no luck

env:
  - name: DYNAMIC_CONFIG_ENABLED
    value: "true"
  - name: KAFKA_CLUSTERS_0_NAME
    value: "kafka-secure"
  - name: KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS
    value: "kafka-bootstrap:9092"
  - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
    value: "SASL_PLAINTEXT"
  - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM
    value: "OAUTHBEARER"
  #- name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_LOGIN_CALLBACK_HANDLER_CLASS
  #  value: "io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler"
  - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
    value: 'org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required oauth.client.id="xxxx" oauth.client.secret="xxxx" oauth.token.endpoint.uri="https://xxxx/auth/realms/kafka-authz/protocol/openid-connect/token";'

If I don't configure unsecuredLoginStringClaim_sub="unused" I get No principal name in JWT claim: sub

If I do set it, I get Token validation failed: Failed to parse JWT

Any pointers are highly appreciated