search

morganstanley / modern-cpp-kafka

A C++ API for Kafka clients (i.e. KafkaProducer, KafkaConsumer, AdminClient)
Apache License 2.0
344 stars 86 forks source link

Does current version support oauthbearer/OIDC? #238

Open leiwang008 opened 2 months ago

leiwang008 commented 2 months ago

I saw that some oauthbearer/OIDC related constants are defined in file https://github.com/morganstanley/modern-cpp-kafka/blob/122678e881de94721458fd948f38e65366b68689/include/kafka/ClientConfig.h#L113

"sasl.oauthbearer.method" "sasl.oauthbearer.client.id" "sasl.oauthbearer.client.secret" "sasl.oauthbearer.scope" "sasl.oauthbearer.token.endpoint.url"

I saw in the readme file, it says By now, modern-cpp-kafka is compatible with librdkafka v2.4.0. I also checked the source code of librdkafka 2.4.0, it already supports the "oauthbearer/OIDC". So I guess that oauthbearer/OIDC is also supported in modern-cpp-kafka, right?

In the KafkaClient.h, you provide the custom callback to parse the token.

    // OAUTHBEARER Toker Refresh Callback
    if (properties.contains(Config::OAUTHBEARER_TOKEN_REFRESH_CB))
    {
        setOauthbearerTokenRefreshCallback(properties.get<OauthbearerTokenRefreshCallback>(Config::OAUTHBEARER_TOKEN_REFRESH_CB));

        rd_kafka_conf_set_oauthbearer_token_refresh_cb(rk_conf.get(), KafkaClient::oauthbearerTokenRefreshCallback);
    }

In my code, I have implemented the custom token callback to parse a json-format token something like {\"Token\":\"**\", \"PrincipalName\":\"**\", \"LeftTimeMS\": 9999999999999, \"extensions\": {\"a\":\"val\", \"b\":\"val\"}} and it worked correctly with the unsecure token or with the azure-oidc token.

I would like to know if current version supports oauthbearer/OIDC? If yes, do we have any example how to use it?

From my reading, I guess that we just need to set those properties in the kafka config "sasl.oauthbearer.method" "sasl.oauthbearer.client.id" "sasl.oauthbearer.client.secret" "sasl.oauthbearer.scope" "sasl.oauthbearer.token.endpoint.url"

and the "sasl.oauthbearer.method" should be set to "oidc" and it will work, right? The kafka-oidc implementation will override my custom token callback, right?

leiwang008 commented 2 months ago

Don't worry about this question, I got it worked. Just set these properties and it works. But we probably should not set the Config::OAUTHBEARER_TOKEN_REFRESH_CB if we use the "oidc", it will cause chaos.