Class OAuthBearerPrincipalResolver

java.lang.Object

io.confluent.kafka.security.authenticator.OAuthBearerPrincipalResolver

public class OAuthBearerPrincipalResolver
extends Object

Resolves a SASL/OAUTHBEARER authentication context into a principal name and the set of groups carried by the JWT. Shared by OAuthKafkaPrincipalBuilder and CpcPrincipalBuilder.

Behavior (unchanged from the original OAuthKafkaPrincipalBuilder implementation):

• Parses the negotiated OAuthBearer token as JWT claims.
• Validates impersonation: if the JWT has a cp_proxy claim and client auth is REQUIRED with validation enabled, the claim must match the mTLS cert identity.
• Selects the groups claim by issuer: Confluent issuer uses groups, otherwise the configured claim name (empty by default → no groups).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	OAuthBearerPrincipalResolver.OAuthBearerResolution

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CONFLUENT_IMPERSONATED_BY_CLAIM_NAME

Constructor Summary

Constructors

Constructor	Description
OAuthBearerPrincipalResolver()

Method Summary

Modifier and Type	Method	Description
void	configure(Map<String,?> configs)
OAuthBearerPrincipalResolver.OAuthBearerResolution	resolve(org.apache.kafka.common.security.auth.SaslAuthenticationContext context)

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CONFLUENT_IMPERSONATED_BY_CLAIM_NAME

public static final String CONFLUENT_IMPERSONATED_BY_CLAIM_NAME

See Also:

• Constant Field Values

Constructor Details

OAuthBearerPrincipalResolver

public OAuthBearerPrincipalResolver()

Method Details

configure

public void configure(Map<String,?> configs)

resolve

public OAuthBearerPrincipalResolver.OAuthBearerResolution resolve(org.apache.kafka.common.security.auth.SaslAuthenticationContext context)