// Module included in the following module:
//
// con-oauth-config.adoc

[id='proc-oauth-client-config-{context}']
= Configuring Kafka Java clients to use OAuth 2.0

This procedure describes how to configure Kafka producer and consumer APIs to use OAuth 2.0 for interaction with Kafka brokers.

Add a client callback plugin to your _pom.xml_ file, and configure the system properties.

.Prerequisites

* Strimzi and Kafka are running
* An OAuth 2.0 authorization server is deployed and configured for OAuth access to Kafka brokers
* Kafka brokers are configured for OAuth 2.0

.Procedure

. Add the client library with OAuth 2.0 support to the `pom.xml` file for the Kafka client:
+
[source,xml,subs="+attributes"]
----
<dependency>
 <groupId>io.strimzi</groupId>
 <artifactId>kafka-oauth-client</artifactId>
 <version>{OAuthVersion}</version>
</dependency>
----

. Configure the system properties for the callback:
+
For example:
+
[source,env, subs="+quotes,attributes"]
----
System.setProperty(ClientConfig.OAUTH_TOKEN_ENDPOINT_URI, “_https://<auth-server-address>/auth/realms/master/protocol/openid-connect/token_”); <1>
System.setProperty(ClientConfig.OAUTH_CLIENT_ID, "_<client_name>_"); <2>
System.setProperty(ClientConfig.OAUTH_CLIENT_SECRET, "_<client_secret>_"); <3>
System.setProperty(ClientConfig.OAUTH_SCOPE, "_<scope_value>_") <4>
System.setProperty(ClientConfig.OAUTH_AUDIENCE, "_<audience_value_") <5>
----
<1> URI of the authorization server token endpoint.
<2> Client ID, which is the name used when creating the _client_ in the authorization server.
<3> Client secret created when creating the _client_ in the authorization server.
<4> (Optional) The `scope` for requesting the token from the token endpoint.
An authorization server may require a client to specify the scope.
<5> (Optional) The `audience` for requesting the token from the token endpoint.
An authorization server may require a client to specify the audience.

. Enable the _OAUTHBEARER_ or _PLAIN_ mechanism on a TLS encrypted connection in the Kafka client configuration.
+
For example:
+
.Enabling OAUTHBEARER for a Kafka client
[source,env]
----
props.put("sasl.jaas.config", "org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;");
props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "OAUTHBEARER");
props.put("sasl.login.callback.handler.class", "io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler");
----
+
.Enabling PLAIN for a Kafka client
[source,env]
----
props.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"$CLIENT_ID_OR_ACCOUNT_NAME\" password=\"$SECRET_OR_ACCESS_TOKEN\" ;");
props.put("security.protocol", "SASL_SSL"); <1>
props.put("sasl.mechanism", "PLAIN");
----
<1> Here we use `SASL_SSL` for use over TLS connections. Use `SASL_PLAINTEXT` over unencrypted connections for local development only.

. Verify that the Kafka client can access the Kafka brokers.
