This system property is used to determine which files, if any, are allowed to be read by the SASL OAUTHBEARER plugin. This property accepts comma-separated list of files. By default the value is an empty list. +
If users want to enable some files, users need to explicitly set the system property like below. +
-Dorg.apache.kafka.sasl.oauthbearer.allowed.files=/tmp/token,/tmp/private_key.pem| Since: | 4.1.0 |
|---|---|
| Default Value: |
This system property is used to set the allowed URLs as SASL OAUTHBEARER token or jwks endpoints. This property accepts comma-separated list of URLs. By default the value is an empty list. diff --git a/docs/security.html b/docs/security.html index a2deee2b3a3..5940fc3cda6 100644 --- a/docs/security.html +++ b/docs/security.html @@ -556,8 +556,8 @@ listener.name.sasl_ssl.plain.sasl.jaas.config=org.apache.kafka.common.security.p
See GSSAPI (Kerberos), PLAIN, - SCRAM or - OAUTHBEARER for example broker configurations.
See GSSAPI (Kerberos), PLAIN, - SCRAM or - OAUTHBEARER for example configurations.
KafkaClient for the selected mechanism as described in the examples
for setting up GSSAPI (Kerberos),
PLAIN,
- SCRAM or
- OAUTHBEARER.
+ SCRAM, or
+ non-production/production OAUTHBEARER.
For example, GSSAPI
credentials may be configured as:
KafkaClient {
@@ -905,10 +905,13 @@ sasl.mechanism=SCRAM-SHA-256 (or SCRAM-SHA-512)principal.builder.class, the principalName of OAuthBearerToken is used as the authenticated Principal for configuration of ACLs etc.
The default implementation of SASL/OAUTHBEARER in Kafka creates and validates Unsecured JSON Web Tokens. + While suitable only for non-production use, it does provide the flexibility to create arbitrary tokens in a DEV or TEST environment.
KafkaServer {
@@ -917,7 +920,40 @@ sasl.mechanism=SCRAM-SHA-256 (or SCRAM-SHA-512)unsecuredLoginStringClaim_sub in the KafkaServer section is used by
the broker when it initiates connections to other brokers. In this example, admin will appear in the
- subject (sub) claim and will be the user for inter-broker communication.sub) claim and will be the user for inter-broker communication.
+
+ Here are the various supported JAAS module options on the broker side for Unsecured JSON Web Token validation: +
| JAAS Module Option for Unsecured Token Validation | +Documentation | +
|---|---|
unsecuredValidatorPrincipalClaimName="value" |
+ Set to a non-empty value if you wish a particular String claim
+ holding a principal name to be checked for existence; the default is to check
+ for the existence of the 'sub' claim. |
+
unsecuredValidatorScopeClaimName="value" |
+ Set to a custom claim name if you wish the name of the String or
+ String List claim holding any token scope to be something other than
+ 'scope'. |
+
unsecuredValidatorRequiredScope="value" |
+ Set to a space-delimited list of scope values if you wish the
+ String/String List claim holding the token scope to be checked to
+ make sure it contains certain values. |
+
unsecuredValidatorAllowableClockSkewMs="value" |
+ Set to a positive integer value if you wish to allow up to some number of + positive milliseconds of clock skew (the default is 0). | +
-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.confKafkaServer {
+ org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ;
+};-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conflisteners=SASL_SSL://host.name:port
+security.inter.broker.protocol=SASL_SSL
+sasl.mechanism.inter.broker.protocol=OAUTHBEARER
+sasl.enabled.mechanisms=OAUTHBEARER
+listener.name.<listener name>.oauthbearer.sasl.server.callback.handler.class=org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler
+listener.name.<listener name>.oauthbearer.sasl.oauthbearer.jwks.endpoint.url=https://example.com/oauth2/v1/keyssub)
claims in sasl.jaas.config.
+ The default implementation of SASL/OAUTHBEARER in Kafka creates and validates Unsecured JSON Web Tokens. + While suitable only for non-production use, it does provide the flexibility to create arbitrary tokens in a DEV or TEST environment.
+Here are the various supported JAAS module options on the client side (and on the broker side if OAUTHBEARER is the inter-broker protocol): +
| JAAS Module Option for Unsecured Token Creation | +Documentation | +
|---|---|
unsecuredLoginStringClaim_<claimname>="value" |
+ Creates a String claim with the given name and value. Any valid
+ claim name can be specified except 'iat' and 'exp' (these are
+ automatically generated). |
+
unsecuredLoginNumberClaim_<claimname>="value" |
+ Creates a Number claim with the given name and value. Any valid
+ claim name can be specified except 'iat' and 'exp' (these are
+ automatically generated). |
+
unsecuredLoginListClaim_<claimname>="value" |
+ Creates a String List claim with the given name and values parsed
+ from the given value where the first character is taken as the delimiter. For
+ example: unsecuredLoginListClaim_fubar="|value1|value2". Any valid
+ claim name can be specified except 'iat' and 'exp' (these are
+ automatically generated). |
+
unsecuredLoginExtension_<extensionname>="value" |
+ Creates a String extension with the given name and value.
+ For example: unsecuredLoginExtension_traceId="123". A valid extension name
+ is any sequence of lowercase or uppercase alphabet characters. In addition, the "auth" extension name is reserved.
+ A valid extension value is any combination of characters with ASCII codes 1-127.
+ |
unsecuredLoginPrincipalClaimName |
+ Set to a custom claim name if you wish the name of the String
+ claim holding the principal name to be something other than 'sub'. |
+
unsecuredLoginLifetimeSeconds |
+ Set to an integer value if the token expiration is to be set to something
+ other than the default value of 3600 seconds (which is 1 hour). The
+ 'exp' claim will be set to reflect the expiration time. |
+
unsecuredLoginScopeClaimName |
+ Set to a custom claim name if you wish the name of the String or
+ String List claim holding any token scope to be something other than
+ 'scope'. |
+
JAAS configuration for clients may alternatively be specified as a JVM parameter similar to brokers
as described here. Clients use the login section named
KafkaClient. This option allows only one user for all client connections from a JVM.
| JAAS Module Option for Unsecured Token Creation | -Documentation | -
|---|---|
unsecuredLoginStringClaim_<claimname>="value" |
- Creates a String claim with the given name and value. Any valid
- claim name can be specified except 'iat' and 'exp' (these are
- automatically generated). |
-
unsecuredLoginNumberClaim_<claimname>="value" |
- Creates a Number claim with the given name and value. Any valid
- claim name can be specified except 'iat' and 'exp' (these are
- automatically generated). |
-
unsecuredLoginListClaim_<claimname>="value" |
- Creates a String List claim with the given name and values parsed
- from the given value where the first character is taken as the delimiter. For
- example: unsecuredLoginListClaim_fubar="|value1|value2". Any valid
- claim name can be specified except 'iat' and 'exp' (these are
- automatically generated). |
-
unsecuredLoginExtension_<extensionname>="value" |
- Creates a String extension with the given name and value.
- For example: unsecuredLoginExtension_traceId="123". A valid extension name
- is any sequence of lowercase or uppercase alphabet characters. In addition, the "auth" extension name is reserved.
- A valid extension value is any combination of characters with ASCII codes 1-127.
- |
unsecuredLoginPrincipalClaimName |
- Set to a custom claim name if you wish the name of the String
- claim holding the principal name to be something other than 'sub'. |
-
unsecuredLoginLifetimeSeconds |
- Set to an integer value if the token expiration is to be set to something
- other than the default value of 3600 seconds (which is 1 hour). The
- 'exp' claim will be set to reflect the expiration time. |
-
unsecuredLoginScopeClaimName |
- Set to a custom claim name if you wish the name of the String or
- String List claim holding any token scope to be something other than
- 'scope'. |
-
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required ;JAAS configuration for clients may alternatively be specified as a JVM parameter similar to brokers
+ as described here. Clients use the login section named
+ KafkaClient. This option allows only one user for all client connections from a JVM.
client_credentials grant type
+ to communicate with the OAuth identity provider, the configuration might look like this:
+ security.protocol=SASL_SSL
+sasl.mechanism=OAUTHBEARER
+sasl.oauthbearer.jwt.retriever.class=org.apache.kafka.common.security.oauthbearer.ClientCredentialsJwtRetriever
+sasl.oauthbearer.client.credentials.client.id=jdoe
+sasl.oauthbearer.client.credentials.client.secret=$3cr3+
+sasl.oauthbearer.scope=my-application-scope
+sasl.oauthbearer.token.endpoint.url=https://example.com/oauth2/v1/tokenurn:ietf:params:oauth:grant-type:jwt-bearer grant type
+ to communicate with the OAuth identity provider, the configuration might look like this:
+ security.protocol=SASL_SSL
+sasl.mechanism=OAUTHBEARER
+sasl.oauthbearer.jwt.retriever.class=org.apache.kafka.common.security.oauthbearer.JwtBearerJwtRetriever
+sasl.oauthbearer.assertion.private.key.file=/path/to/private.key
+sasl.oauthbearer.assertion.algorithm=RS256
+sasl.oauthbearer.assertion.claim.exp.seconds=600
+sasl.oauthbearer.assertion.template.file=/path/to/template.json
+sasl.oauthbearer.scope=my-application-scope
+sasl.oauthbearer.token.endpoint.url=https://example.com/oauth2/v1/token| JAAS Module Option for Unsecured Token Validation | -Documentation | -
|---|---|
unsecuredValidatorPrincipalClaimName="value" |
- Set to a non-empty value if you wish a particular String claim
- holding a principal name to be checked for existence; the default is to check
- for the existence of the 'sub' claim. |
-
unsecuredValidatorScopeClaimName="value" |
- Set to a custom claim name if you wish the name of the String or
- String List claim holding any token scope to be something other than
- 'scope'. |
-
unsecuredValidatorRequiredScope="value" |
- Set to a space-delimited list of scope values if you wish the
- String/String List claim holding the token scope to be checked to
- make sure it contains certain values. |
-
unsecuredValidatorAllowableClockSkewMs="value" |
- Set to a positive integer value if you wish to allow up to some number of - positive milliseconds of clock skew (the default is 0). | -