harmadasg opened a new pull request, #24017: URL: https://github.com/apache/kafka/pull/24017
When a JWKS endpoint is configured, the broker's SASL/OAUTHBEARER validator now requires both sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience to be set, and the broker fails fast at startup otherwise, so the issuer and audience of incoming tokens are verified by default. Operators that intentionally do not restrict the issuer or audience can opt out via sasl.oauthbearer.allow.unverified.issuer=true and/or sasl.oauthbearer.allow.unverified.audience=true; a startup warning is logged when an opt-out is enabled. - Add sasl.oauthbearer.allow.unverified.issuer and sasl.oauthbearer.allow.unverified.audience (boolean, default false) to both the client and broker config definitions. - Raise the importance of sasl.oauthbearer.expected.issuer and sasl.oauthbearer.expected.audience to HIGH. - BrokerJwtValidator fails fast when an expected value is missing without the matching opt-out, and skips jose4j's default audience validation when the audience opt-out is enabled. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
