Implementation of OAUTHBEARER/OIDC metadata based authentication #5155

emasab · 2025-08-01T14:56:28Z

initially supporting the Azure UAMI method.

confluent-cla-assistant · 2025-08-01T14:56:38Z

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

Copilot

Pull Request Overview

This PR implements OAUTHBEARER/OIDC metadata-based authentication, initially supporting the Azure UAMI (User Assigned Managed Identity) method for token retrieval.

Adds Azure UAMI metadata authentication support for OAUTHBEARER/OIDC
Refactors HTTP client to support custom headers and retry logic
Introduces configuration parameter for metadata authentication type

Reviewed Changes

Copilot reviewed 13 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/rdkafka_sasl_oauthbearer_oidc.c	Implements Azure metadata token refresh callback with HTTP calls to Azure UAMI endpoint
src/rdkafka_sasl_oauthbearer_oidc.h	Declares the new Azure metadata token refresh callback function
src/rdkafka_conf.h	Adds metadata authentication type enum and configuration structure
src/rdkafka_conf.c	Adds configuration property and refactors OIDC validation logic into separate functions
src/rdkafka_sasl_oauthbearer.c	Simplifies builtin token refresh callback detection logic
src/rdkafka.c	Integrates Azure metadata authentication into the OIDC token refresh mechanism
src/rdhttp.h	Updates HTTP client interface to support headers, timeouts, and retries
src/rdhttp.c	Enhances HTTP client with parameter appending, custom headers, and retry functionality
CONFIGURATION.md	Documents the new metadata authentication type configuration parameter
tests/0126-oauthbearer_oidc.c	Removes duplicate configuration line in test

src/rdkafka_sasl_oauthbearer_oidc.c

src/rdhttp.c

src/rdkafka_sasl_oauthbearer_oidc.c

milindl

some minor comments, one not-so-minor comment, thanks for making the PR

milindl · 2025-09-17T09:47:24Z

src/rdkafka_sasl_oauthbearer_oidc.c

+ * @brief Implementation of Oauth/OIDC token refresh callback function
+ *        for Azure IMDS,
+ *        will receive the JSON response after HTTP(S) GET call to token
+ * provider, then extract the jwt from the JSON response, and forward it to the


nit: fix alignment

milindl · 2025-09-17T09:49:27Z

INTRODUCTION.md

+
+###### Azure IMDS
+
+to use this method you set:


Suggested change

to use this method you set:

To use this method you set:

milindl · 2025-09-17T09:50:10Z

INTRODUCTION.md

+* `sasl.oauthbearer.metadata.authentication.type=azure_imds` this make that ` sasl.oauthbearer.client.id`
+and `sasl.oauthbearer.client.secret` aren't required


Suggested change

* `sasl.oauthbearer.metadata.authentication.type=azure_imds` this make that ` sasl.oauthbearer.client.id`

and `sasl.oauthbearer.client.secret` aren't required

* `sasl.oauthbearer.metadata.authentication.type=azure_imds` this makes it so that ` sasl.oauthbearer.client.id`

and `sasl.oauthbearer.client.secret` aren't required.

milindl · 2025-09-17T09:50:39Z

INTRODUCTION.md

+* `sasl.oauthbearer.config` is a general purpose configuration property
+  In this case it's accepts comma-separated `key=value` pairs.


Suggested change

* `sasl.oauthbearer.config` is a general purpose configuration property

In this case it's accepts comma-separated `key=value` pairs.

* `sasl.oauthbearer.config` is a general purpose configuration property.

In this case its accepts comma-separated `key=value` pairs.

milindl · 2025-09-17T09:51:35Z

INTRODUCTION.md

+  The `params` key is required and its value is the GET query string to append
+  to the token endpoint URL. Such query string contains params required by
+  Azure IMDS such as `client_id` (the UAMI), `resource` for determining the
+  target audience and `api-version` for the API version to be used by the endpoint
+* `sasl.oauthbearer.token.endpoint.url` (optional) is set automatically
+  when chosing `sasl.oauthbearer.metadata.authentication.type=azure_imds` but can
+  be customized


Suggested change

The `params` key is required and its value is the GET query string to append

to the token endpoint URL. Such query string contains params required by

Azure IMDS such as `client_id` (the UAMI), `resource` for determining the

target audience and `api-version` for the API version to be used by the endpoint

* `sasl.oauthbearer.token.endpoint.url` (optional) is set automatically

when chosing `sasl.oauthbearer.metadata.authentication.type=azure_imds` but can

be customized

The `params` key is required and its value is the GET query string to append

to the token endpoint URL. Such a query string contains params required by

Azure IMDS, such as `client_id` (the UAMI), `resource` for determining the

target audience and `api-version` for the API version to be used by the endpoint.

* `sasl.oauthbearer.token.endpoint.url` (optional) is set automatically

when choosing `sasl.oauthbearer.metadata.authentication.type=azure_imds` but can

be customized.

milindl · 2025-09-17T10:30:37Z

src/rdhttp.c

+ *
+ * @returns A newly allocated string with the appended parameters.
+ */
+char *rd_http_get_params_append(const char *url, const char *params) {


rather than rolling our url builder, is it okay to use curl instead? that way well tested code is used, for example:

CURLUcode rc = curl_url_set(h, CURLUPART_URL, "https://example.com:449/foo/bar#abc", 0); rc = curl_url_set(h, CURLUPART_QUERY, "param1=N", CURLU_APPENDQUERY | CURLU_URLENCODE); // can choose to urlencode or not rc = curl_url_set(h, CURLUPART_QUERY, "param2=3", CURLU_APPENDQUERY | CURLU_URLENCODE); rc = curl_url_set(h, CURLUPART_FRAGMENT, NULL, 0); // remove hash fragment char *url; rc = curl_url_get(h, CURLUPART_URL, &url, 0); printf("%s\n", url);

emasab · 2025-09-25T15:30:53Z

trviup PR is here
emasab/trivup#8

…tially supporting the Azure UAMI method.

based authentications

entry

…ntity with IMDS that is the authentication service

function and enums

…" as in other implementations and to make it optional if the default endpoint is overridden.

milindl

Thanks for addressing the comments

* Implementation of OAUTHBEARER/OIDC metadata based authentication, initially supporting the Azure UAMI method. * Tests with trivup 0.14.0 supporting metadata based authentications * Add documentation and changelog entry * Rename `azure` value to `azure_imds` and replace UAMI that is the identity with IMDS that is the authentication service * Extract authentication URL and rename internal function and enums * Changes to name the configuration property "query" instead of "params" as in other implementations and to make it optional if the default endpoint is overridden.

Copilot AI review requested due to automatic review settings August 1, 2025 14:56

emasab requested a review from a team as a code owner August 1, 2025 14:56

Copilot AI reviewed Aug 1, 2025

View reviewed changes

src/rdkafka_sasl_oauthbearer_oidc.c Outdated Show resolved Hide resolved

src/rdhttp.c Outdated Show resolved Hide resolved

src/rdhttp.c Outdated Show resolved Hide resolved

src/rdhttp.c Outdated Show resolved Hide resolved

src/rdkafka_sasl_oauthbearer_oidc.c Outdated Show resolved Hide resolved

airlock-confluentinc bot force-pushed the dev_oauthbearer_metadata_based branch 4 times, most recently from e1c95a8 to 45f2a29 Compare August 5, 2025 08:25

airlock-confluentinc bot force-pushed the dev_oauthbearer_metadata_based branch from 45f2a29 to 26d990a Compare August 25, 2025 19:57

milindl reviewed Sep 17, 2025

View reviewed changes

emasab added 9 commits September 25, 2025 17:56

Implementation of OAUTHBEARER/OIDC metadata based authentication, ini…

da6b8a6

…tially supporting the Azure UAMI method.

Tests with trivup 0.14.0 supporting metadata

a9695c3

based authentications

Add documentation and changelog

29b98b2

entry

Rename azure value to azure_imds and replace UAMI that is the ide…

3e1470a

…ntity with IMDS that is the authentication service

Extract authentication URL and rename internal

522fe1f

function and enums

Better documentation

6651c62

Accress Copilot comments

a0879b4

Address comments

14afbfb

Changes to name the configuration property "query" instead of "params…

7d356de

…" as in other implementations and to make it optional if the default endpoint is overridden.

airlock-confluentinc bot force-pushed the dev_oauthbearer_metadata_based branch from a7e64d8 to 7d356de Compare September 25, 2025 15:59

milindl approved these changes Sep 26, 2025

View reviewed changes

emasab merged commit ad90e9b into master Sep 26, 2025
2 checks passed

emasab deleted the dev_oauthbearer_metadata_based branch September 26, 2025 16:07

		* `sasl.oauthbearer.metadata.authentication.type=azure_imds` this make that ` sasl.oauthbearer.client.id`
		and `sasl.oauthbearer.client.secret` aren't required

		* `sasl.oauthbearer.config` is a general purpose configuration property
		In this case it's accepts comma-separated `key=value` pairs.

Implementation of OAUTHBEARER/OIDC metadata based authentication #5155

Implementation of OAUTHBEARER/OIDC metadata based authentication #5155

Uh oh!

Conversation

emasab commented Aug 1, 2025

Uh oh!

confluent-cla-assistant bot commented Aug 1, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

milindl left a comment

Choose a reason for hiding this comment

Uh oh!

milindl Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

milindl Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

milindl Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

milindl Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

milindl Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

milindl Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

emasab commented Sep 25, 2025

Uh oh!

milindl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants