io.confluent.security.auth.provider.oauth

Class EnhancedOAuthBearerValidatorCallbackHandler

java.lang.Object

io.confluent.security.auth.provider.oauth.EnhancedOAuthBearerValidatorCallbackHandler

All Implemented Interfaces:

CallbackHandler, org.apache.kafka.common.security.auth.AuthenticateCallbackHandler

public class EnhancedOAuthBearerValidatorCallbackHandler
extends Object
implements org.apache.kafka.common.security.auth.AuthenticateCallbackHandler

A CallbackHandler that recognizes OAuthBearerValidatorCallback and OAuthBearerExtensionsValidatorCallback for validating a secured OAuth 2 bearer token issued by Confluent/external OIDC provider, SASL extensions specifying the logical cluster this token is meant for and an identity pool ID to assume if token is from external OIDC provider.

It verifies the signature of the JWTToken through a public key it retrieves from KeyResolver provided by JwtAuthenticator

This class must be explicitly set via the listener.name.<listenerName>.oauthbearer.sasl.server.callback.handler.class broker configuration property.

Constructor Summary

Constructors

Constructor and Description
EnhancedOAuthBearerValidatorCallbackHandler()

Method Summary

Modifier and Type	Method and Description
protected boolean	checkSniHostNameMatched(org.apache.kafka.common.security.oauthbearer.OAuthBearerExtensionsValidatorCallback callback, String logicalClusterId, String sniHostName, SniValidationMode sniValidationMode)
void	close()
void	configure(Map<String,?> configs, String saslMechanism, List<AppConfigurationEntry> jaasConfigEntries)
void	handle(Callback[] callbacks)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EnhancedOAuthBearerValidatorCallbackHandler

public EnhancedOAuthBearerValidatorCallbackHandler()

Method Detail

configure

public void configure(Map<String,?> configs,
                      String saslMechanism,
                      List<AppConfigurationEntry> jaasConfigEntries)

Specified by:

configure in interface org.apache.kafka.common.security.auth.AuthenticateCallbackHandler

handle

public void handle(Callback[] callbacks)
            throws UnsupportedCallbackException

Specified by:

handle in interface CallbackHandler

Throws:

UnsupportedCallbackException

close

public void close()

Specified by:

close in interface org.apache.kafka.common.security.auth.AuthenticateCallbackHandler

checkSniHostNameMatched

protected boolean checkSniHostNameMatched(org.apache.kafka.common.security.oauthbearer.OAuthBearerExtensionsValidatorCallback callback,
                                          String logicalClusterId,
                                          String sniHostName,
                                          SniValidationMode sniValidationMode)