AKS Workload Identity to Kafka SASL OAUTHBEARER Login Callback Handler

Kafka Client Login Callback Handler to be used in Kafka Clients authenticating to an OAuth2 enabled Kafka Broker AND running on an Azure Service with Workload Identity enabled.

This LoginCallbackHandler is a replacement for the default included OAuthBearerLoginCallbackHandler

This LoginCallbackHandler uses the Environment variables defined in the Mutating Admission Webhook Controller for AKS Workload Identity to configure the Azure Identity WorkloadIdentityCredential.

Usage

Configure this Kafka Client Login Callback Handler to be used by setting

sasl.login.callback.handler.class=io.github.nniikkoollaaii.kafka.sasl.oauthbearer.workload_identity.WorkloadIdentityLoginCallbackHandler

Testing

see here

ToDo

• Make scope configurable

• Make env names configurable

• Implement other configuration options than reading from env vars. Like extension attributes with value for e.g. token file path or client id.

Develop

mvn install