Kafka SASL Authentication mechanism using OAuthBearer?

Question

Can anyone help me to write JAAS conf files and Handler classes for Authentication using SASL/OAUTHBEARER?

And also what is the meaning of this option in JAAS file which is configured in kafka documentation?

unsecuredLoginStringClaim_sub="admin"; 

Answer 1

For SASL/OAUTHBEARER the JAAS config file will be, at least:

KafkaServer {
   org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ;
};

Other params will be used by your implementation of the interface AuthenticateCallbackHandler that can receive other parameters like your OAuth server host, grant type or other information that you need to do the login flow. The option unsecuredLoginStringClaim_sub="admin" is one of these parameters.

If you need to setup and test a Kafka broker with this SASL mechanism, you can see this article. https://medium.com/@jairsjunior/how-to-setup-oauth2-mechanism-to-a-kafka-broker-e42e72839fe

Answer 2

See the Javadoc at https://github.com/apache/kafka/blob/trunk/clients/src/main/java/org/apache/kafka/common/security/oauthbearer/OAuthBearerLoginModule.java for an explanation of unsecuredLoginStringClaim_sub="admin" -- that is an option that is recognized by the default unsecured callback handlers you get out-of-the-box.