Doc for complexe oauth 2 configuration #28
Conversation
added a readme part to configure the kafka ui with an SASL_SSL oauthbearer configuration
|
|
||
| # Goals | ||
|
|
||
| This configuration provide complexe configuration to do SASL_SSL with Oauthbearer configuration between the UI Kafka Client and a Kafka Cluster with jwt and scope validation. |
There was a problem hiding this comment.
Hi, could you please proofread and fix english here? You can use free tools like Grammarly or chatgpt to automate this.
| - name: KAFKA_CLUSTERS_0_PROPERTIES_ENDPOINT_IDENTIFICATION_ALGORITHM | ||
| value: "" | ||
| - name: JAVA_OPTS | ||
| value: -Djavax.net.ssl.trustStore=/var/run/secrets/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit |
There was a problem hiding this comment.
what's the point of a truststore here if SSL for kafka is disabled? (KAFKA_CLUSTERS_0_PROPERTIES_ENDPOINT_IDENTIFICATION_ALGORITHM is empty)
There was a problem hiding this comment.
it's a mistake will remove this endpoint algorithm to use the default https
| - name: JAVA_OPTS | ||
| value: -Djavax.net.ssl.trustStore=/var/run/secrets/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit | ||
| - name: KAFKA_CLUSTERS_0_SCHEMAREGISTRY | ||
| value: https://broker-apicurio-schema-registry-service:8443/apis/ccompat/v7 |
There was a problem hiding this comment.
please note in the guide header that this guide is for apicurio, these are quite specific details of this setup, but still the overall guide might be useful for others, it's just that it would be nice to know what one's dealing with before going deep into the details
| value: OAUTHBEARER | ||
| - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_LOGIN_CALLBACK_HANDLER_CLASS | ||
| value: io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler | ||
| - name: OAUTH_CLIENT_ID |
There was a problem hiding this comment.
what are these properties for? k-ui doesn't have properties like that. It's auth.oauth2.client.<name>.clientId in our app
There was a problem hiding this comment.
this is also due to the specific Redhat Kafka distribution (strimzi). I will mention it in the header
added a readme part to configure the kafka ui with an SASL_SSL oauthbearer client configuration