Package io.confluent.kafka.schemaregistry.client.security.bearerauth.oauth

Class UamiCredentialProvider

java.lang.Object

io.confluent.kafka.schemaregistry.client.security.bearerauth.oauth.UamiCredentialProvider

All Implemented Interfaces:

BearerAuthCredentialProvider, Closeable, AutoCloseable, org.apache.kafka.common.Configurable

public class UamiCredentialProvider
extends Object
implements BearerAuthCredentialProvider

UamiCredentialProvider is a BearerAuthCredentialProvider that authenticates to Schema Registry using an Azure User Assigned Managed Identity (UAMI).

It retrieves a bearer token from the Azure Instance Metadata Service (IMDS) using UamiJwtRetriever, caches the token via CachedOauthTokenRetriever, and proactively refreshes it before expiry using OauthTokenCache.

Required configuration:

• SchemaRegistryClientConfig.BEARER_AUTH_UAMI_ENDPOINT_QUERY - The pre-formatted query string appended to the IMDS endpoint URL (e.g. api-version=2025-04-07&resource=https%3A%2F%2Fconfluent.azure.com&client_id=...).

Optional configuration:

• SchemaRegistryClientConfig.BEARER_AUTH_UAMI_ENDPOINT_URL - IMDS endpoint URL. Defaults to UamiJwtRetriever.DEFAULT_IMDS_ENDPOINT. Override for Azure Arc or non-standard environments.
• SchemaRegistryClientConfig.BEARER_AUTH_CACHE_EXPIRY_BUFFER_SECONDS - Seconds before token expiry to treat the cached token as stale. Defaults to 300.
• SchemaRegistryClientConfig.BEARER_AUTH_SCOPE_CLAIM_NAME - JWT claim used for scope. Defaults to scope; set to scp for standard Azure tokens.
• SchemaRegistryClientConfig.BEARER_AUTH_SUB_CLAIM_NAME - JWT claim used for subject. Defaults to sub.
• SchemaRegistryClientConfig.BEARER_AUTH_LOGICAL_CLUSTER - Target Schema Registry logical cluster ID.
• SchemaRegistryClientConfig.BEARER_AUTH_IDENTITY_POOL_ID - Target identity pool ID.

To activate, set:

   bearer.auth.credentials.source=UAMI
   bearer.auth.issuer.endpoint.query=api-version=2025-04-07&resource=...&client_id=...
 

Constructor Summary

Constructors

Constructor	Description
UamiCredentialProvider()

Method Summary

Modifier and Type	Method	Description
String	alias()
void	configure(Map<String,?> map)
String	getBearerToken(URL url)
String	getTargetIdentityPoolId()
String	getTargetSchemaRegistry()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.confluent.kafka.schemaregistry.client.security.bearerauth.BearerAuthCredentialProvider

close

Constructor Details

UamiCredentialProvider

public UamiCredentialProvider()

Method Details

alias

public String alias()

Specified by:

alias in interface BearerAuthCredentialProvider

getBearerToken

public String getBearerToken(URL url)

Specified by:

getBearerToken in interface BearerAuthCredentialProvider

getTargetSchemaRegistry

public String getTargetSchemaRegistry()

Specified by:

getTargetSchemaRegistry in interface BearerAuthCredentialProvider

getTargetIdentityPoolId

public String getTargetIdentityPoolId()

Specified by:

getTargetIdentityPoolId in interface BearerAuthCredentialProvider

configure

public void configure(Map<String,?> map)

Specified by:

configure in interface org.apache.kafka.common.Configurable