Package org.apache.kafka.common.security.oauthbearer

Class JwtBearerJwtRetriever

java.lang.Object
org.apache.kafka.common.security.oauthbearer.JwtBearerJwtRetriever
All Implemented Interfaces:
Closeable, AutoCloseable, org.apache.kafka.common.security.oauthbearer.internals.secured.OAuthBearerConfigurable, JwtRetriever
public class JwtBearerJwtRetriever extends Object implements JwtRetriever
JwtBearerJwtRetriever is a JwtRetriever that performs the steps to request a JWT from an OAuth/OIDC identity provider using the urn:ietf:params:oauth:grant-type:jwt-bearer grant type. This grant type is used for machine-to-machine "service accounts".

This JwtRetriever is enabled by specifying its class name in the Kafka configuration. For client use, specify the class name in the sasl.oauthbearer.jwt.retriever.class configuration like so: 

 sasl.oauthbearer.jwt.retriever.class=org.apache.kafka.common.security.oauthbearer.JwtBearerJwtRetriever

If using this JwtRetriever on the broker side (for inter-broker communication), the configuration should be specified with a listener-based property: 

 listener.name.<listener name>.oauthbearer.sasl.oauthbearer.jwt.retriever.class=org.apache.kafka.common.security.oauthbearer.JwtBearerJwtRetriever

The JwtBearerJwtRetriever also uses the following configuration:

  • sasl.oauthbearer.assertion.algorithm
  • sasl.oauthbearer.assertion.claim.aud
  • sasl.oauthbearer.assertion.claim.exp.seconds
  • sasl.oauthbearer.assertion.claim.iss
  • sasl.oauthbearer.assertion.claim.jti.include
  • sasl.oauthbearer.assertion.claim.nbf.seconds
  • sasl.oauthbearer.assertion.claim.sub
  • sasl.oauthbearer.assertion.file
  • sasl.oauthbearer.assertion.private.key.file
  • sasl.oauthbearer.assertion.private.key.passphrase
  • sasl.oauthbearer.assertion.template.file
  • sasl.oauthbearer.jwt.retriever.class
  • sasl.oauthbearer.scope
  • sasl.oauthbearer.token.endpoint.url
Please refer to the official Apache Kafka documentation for more information on these, and related, configuration.

Here's an example of the JAAS configuration for a Kafka client: 

 sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ;

 sasl.oauthbearer.assertion.algorithm=RS256
 sasl.oauthbearer.assertion.claim.aud=my-application-audience
 sasl.oauthbearer.assertion.claim.exp.seconds=600
 sasl.oauthbearer.assertion.claim.iss=my-oauth-issuer
 sasl.oauthbearer.assertion.claim.jti.include=true
 sasl.oauthbearer.assertion.claim.nbf.seconds=120
 sasl.oauthbearer.assertion.claim.sub=kafka-app-1234
 sasl.oauthbearer.assertion.private.key.file=/path/to/private.key
 sasl.oauthbearer.assertion.private.key.passphrase=$3cr3+
 sasl.oauthbearer.assertion.template.file=/path/to/assertion-template.json
 sasl.oauthbearer.jwt.retriever.class=org.apache.kafka.common.security.oauthbearer.JwtBearerJwtRetriever
 sasl.oauthbearer.scope=my-application-scope
 sasl.oauthbearer.token.endpoint.url=https://example.com/oauth2/v1/token

  • Constructor Details

    • JwtBearerJwtRetriever

      public JwtBearerJwtRetriever()

    • JwtBearerJwtRetriever

      public JwtBearerJwtRetriever(org.apache.kafka.common.utils.Time time)

  • Method Details

    • configure

      public void configure(Map<String,?> configs, String saslMechanism, List<AppConfigurationEntry> jaasConfigEntries)
      Specified by:
      configure in interface org.apache.kafka.common.security.oauthbearer.internals.secured.OAuthBearerConfigurable

    • retrieve

      public String retrieve() throws JwtRetrieverException
      Description copied from interface: JwtRetriever
      Retrieves a JWT access token in its serialized three-part form. The implementation is free to determine how it should be retrieved but should not perform validation on the result. Note: This is a blocking function and callers should be aware that the implementation may be communicating over a network, with the file system, coordinating threads, etc. The facility in the LoginModule from which this is ultimately called does not provide an asynchronous approach.
      Specified by:
      retrieve in interface JwtRetriever
      Returns:
      Non-null JWT access token string
      Throws:
      JwtRetrieverException - Thrown on errors related to IO during retrieval

    • close

      public void close() throws IOException
      Specified by:
      close in interface AutoCloseable
      Specified by:
      close in interface Closeable
      Specified by:
      close in interface org.apache.kafka.common.security.oauthbearer.internals.secured.OAuthBearerConfigurable
      Throws:
      IOException