SASL/OAUTHBEARER Authentication

Requires Agent Version: v745

SASL/OAUTHBEARER Authentication uses OAuth tokens based on the Java Web Token (JWT) standard to authenticate your Kafka clients. By default Kafka clients communicating with WarpStream Agents use PLAINTEXT, meaning that all data is sent in plain text (unencrypted), this includes the SASL credentials.

When using SASL it is recommended to Configure TLS Encrpytion for your WarpStream Cluster.

Configure WarpStream Agents

Set the requireSASLAuthentication flag or WARPSTREAM_REQUIRE_SASL_AUTHENTICATION=true environment variable on the Agents. If limiting SASL authentication methods via the enabledSASLMechanisms flag or WARPSTREAM_ENABLED_SASL_MECHANISMS environment variable make sure OAUTHBEARER is added.

Set the saslOauthIssuerURL flag or WARPSTREAM_SASL_OAUTH_ISSUER_URL environment variable to the URL of your OAuth provider for example https://example.okta.com/oauth2/default. Set the saslOauthAudience flag or WARPSTREAM_SASL_OAUTH_AUDIENCE to the OAuth provider audience for example api://default.

Once configured is enabled on the Agents, they will enforce that all Apache Kafka clients that connect to them authenticate themselves via SASL. Improperly authenticated clients will be unable to connect.

Configure Kafka clients

For configuring SASL/OAUTHBEARER in your Kafka clients it is recommended to review the documentation for your Kafka client. Every Kafka client configures SASL/OAUTHBEARER differently and those configurations may change version to version.

We recommend using the Confluent Platform documentation to learn how to configure Java-based clients for SASL/OAUTHBEARER.