// Module included in the following module:
//
// con-oauth-config.adoc

[id='proc-oauth-kafka-config-{context}']
= Configuring OAuth 2.0 for Kafka components

This procedure describes how to configure Kafka components to use OAuth 2.0 authentication using an authorization server.

You can configure authentication for:

* Kafka Connect
* Kafka MirrorMaker
* Kafka Bridge

In this scenario, the Kafka component and the authorization server are running in the same cluster.

.Before you start

For more information on the configuration of OAuth 2.0 authentication for Kafka components, see the link:{BookURLConfiguring}#type-KafkaClientAuthenticationOAuth-reference[`KafkaClientAuthenticationOAuth` schema reference^].
The schema reference includes examples of configuration options.

.Prerequisites

* Strimzi and Kafka are running
* An OAuth 2.0 authorization server is deployed and configured for OAuth access to Kafka brokers
* Kafka brokers are configured for OAuth 2.0

.Procedure

. Create a client secret and mount it to the component as an environment variable.
+
For example, here we are creating a client `Secret` for the Kafka Bridge:
+
[source,yaml,subs="+quotes,attributes"]
----
apiVersion: {KafkaApiVersion}
kind: Secret
metadata:
 name: my-bridge-oauth
type: Opaque
data:
 clientSecret: MGQ1OTRmMzYtZTllZS00MDY2LWI5OGEtMTM5MzM2NjdlZjQw <1>
----
<1> The `clientSecret` key must be in base64 format.

. Create or edit the resource for the Kafka component so that OAuth 2.0 authentication is configured for the authentication property.
+
For OAuth 2.0 authentication, you can use the following options:
+
--
* Client ID and secret
* Client ID and refresh token
* Access token
* Username and password
* TLS
--
+
For example, here OAuth 2.0 is assigned to the Kafka Bridge client using a client ID and secret, and TLS:
+
[source,yaml,subs="+quotes,attributes"]
----
apiVersion: {KafkaApiVersion}
kind: KafkaBridge
metadata:
  name: my-bridge
spec:
  # ...
  authentication:
    type: oauth <1>
    tokenEndpointUri: https://<auth-server-address>/auth/realms/master/protocol/openid-connect/token <2>
    clientId: kafka-bridge
    clientSecret:
      secretName: my-bridge-oauth
      key: clientSecret
    tlsTrustedCertificates: <3>
    - secretName: oauth-server-cert
      certificate: tls.crt
----
<1> Authentication type set to `oauth`.
<2> URI of the token endpoint for authentication.
<3> Trusted certificates for TLS connection to the authorization server.
+
Depending on how you apply OAuth 2.0 authentication, and the type of authorization server, there are additional configuration options you can use:
+
[source,yaml,subs="+quotes,attributes"]
----
# ...
spec:
  # ...
  authentication:
    # ...
    disableTlsHostnameVerification: true <1>
    checkAccessTokenType: false <2>
    accessTokenIsJwt: false <3>
    scope: any <4>
    audience: kafka <5>
    connectTimeoutSeconds: 60 <6>
    readTimeoutSeconds: 60 <7>
    httpRetries: 2 <8>
    httpRetryPauseMs: 300 <9>
    includeAcceptHeader: false <10>
----
<1> (Optional) Disable TLS hostname verification. Default is `false`.
<2> If the authorization server does not return a `typ` (type) claim inside the JWT token, you can apply `checkAccessTokenType: false` to skip the token type check. Default is `true`.
<3> If you are using opaque tokens, you can apply `accessTokenIsJwt: false` so that access tokens are not treated as JWT tokens.
<4> (Optional) The `scope` for requesting the token from the token endpoint.
An authorization server may require a client to specify the scope.
In this case it is `any`.
<5> (Optional) The `audience` for requesting the token from the token endpoint.
An authorization server may require a client to specify the audience.
In this case it is `kafka`.
<6> (Optional) The connect timeout in seconds when connecting to the authorization server. The default value is 60.
<7> (Optional) The read timeout in seconds when connecting to the authorization server. The default value is 60.
<8> (Optional) The maximum number of times to retry a failed HTTP request to the authorization server. The default value is `0`, meaning that no retries are performed. To use this option effectively, consider reducing the timeout times for the `connectTimeoutSeconds` and `readTimeoutSeconds` options. However, note that retries may prevent the current worker thread from being available to other requests, and if too many requests stall, it could make the Kafka broker unresponsive.
<9> (Optional) The time to wait before attempting another retry of a failed HTTP request to the authorization server. By default, this time is set to zero, meaning that no pause is applied. This is because many issues that cause failed requests are per-request network glitches or proxy issues that can be resolved quickly. However, if your authorization server is under stress or experiencing high traffic, you may want to set this option to a value of 100 ms or more to reduce the load on the server and increase the likelihood of successful retries.
<10> (Optional) Some authorization servers have issues with client sending `Accept: application/json` header. By setting `includeAcceptHeader: false` the header will not be sent. Default is `true`.
. Apply the changes to the deployment of your Kafka resource.
+
[source,yaml,subs="+quotes,attributes"]
----
kubectl apply -f your-file
----

. Check the update in the logs or by watching the pod state transitions:
+
[source,yaml,subs="+quotes,attributes"]
----
kubectl logs -f ${POD_NAME} -c ${CONTAINER_NAME}
kubectl get pod -w
----
+
The rolling updates configure the component for interaction with Kafka brokers using OAuth 2.0 authentication.
