Question: SASL OAUTHBEARER Configuration Like Kafka Consumer/Producer

[ssijbabu]

Hello,

We are currently exploring options for securing our Kafka exporter's connection to our Kafka cluster using SASL OAUTHBEARER for authentication. We are familiar with configuring Kafka consumers and producers with properties similar to the following:

security.protocol=SASL_PLAINTEXT
sasl.mechanism=OAUTHBEARER
sasl.login.callback.handler.class=com.oauth2.security.oauthbearer.OAuthAuthenticateLoginCallbackHandler
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required
 OAUTH_LOGIN_SERVER=<OAuth-server-url>
 OAUTH_LOGIN_ENDPOINT='/oauth2/default/v1/token'
 OAUTH_LOGIN_GRANT_TYPE=client_credentials
 OAUTH_LOGIN_SCOPE=kafka
 OAUTH_AUTHORIZATION='Basic <encoded-producer-clientId:clientsecret>'
 OAUTH_INTROSPECT_SERVER=<OAuth-server-url>
 OAUTH_INTROSPECT_ENDPOINT='/oauth2/default/v1/introspect'
 OAUTH_INTROSPECT_AUTHORIZATION='Basic <encoded-producer-clientId:clientsecret>';

Our question is two-fold:

1. How can we configure the Kafka exporter to use SASL OAUTHBEARER for authentication with our Kafka cluster? Are there specific configuration parameters or a different approach required compared to Kafka clients?
2. Does the current version of the Kafka exporter support the direct use of properties similar to the ones listed above? If so, where should these properties be configured (e.g., command-line arguments, configuration file)? If not, what is the recommended way to achieve SASL OAUTHBEARER authentication for the exporter?

We are looking to leverage OAUTHBEARER for enhanced security and centralized authentication management. Any guidance or information on how to achieve this with the Kafka exporter would be greatly appreciated.

Thank you.

[ssijbabu]

Tagging @pavolloffay @MovieStoreGuy @axw

[axw]

OAUTHBEARER is not currently generally supported by the Kafka exporter (or other Kafka components), only the AWS MSK-specific variation. I suggest opening a feature request issue. I probably wouldn't have capacity to implement it myself, but by opening an issue someone else may pick it up.

Regarding configuration, it would be configured like anything else in the collector -- see https://opentelemetry.io/docs/collector/configuration/ for the general concepts. I don't know off hand how this would be configured, but it should probably be aligned with https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/extension/oauth2clientauthextension