<a id="cmf-authenticate"></a>

# Configure Authentication for Confluent Manager for Apache Flink

Flink applications are deployed in Confluent Platform with Confluent Manager for Apache Flink® (CMF), a
central management component that enables users to securely manage a fleet of Flink jobs
across multiple environments.

By default, CMF installs with authentication disabled, and it must be enabled.
This topic describes how to configure authentication for CMF.

CMF supports [mutual TLS (mTLS) authentication](/platform/current/security/authentication/mutual-tls/overview.html) and [OAuth authentication](/platform/current/security/authentication/oauth-oidc/overview.html) only.

When CMF runs the embedded MDS (`cmf.mds.enabled: true`), the embedded
MDS authenticates users through OIDC, LDAP, or a file-based user store and
issues or validates their tokens. CMF still requires the
`cmf.authentication` settings described on this page, usually with
`type: oauth`, to authenticate each API request. The embedded MDS does not
require an external Kafka cluster. For configuration details, see
[Configure Embedded MDS for Confluent Manager for Apache Flink](embedded-mds.md#cmf-embedded-mds).

<a id="cmf-ssl-contexts"></a>

## Understanding SSL configuration in CMF

CMF uses SSL/TLS in two independent contexts. These are configured separately
and do not share any settings:

`cmf.ssl.*` — Server SSL/TLS
: Configures HTTPS for incoming client connections to the CMF server.
  These settings map to Spring Boot `server.ssl.*` properties and control the
  server’s keystore, truststore, and client certificate requirements. They do not
  affect outbound connections from CMF.

`confluent.metadata.ssl.*` — CMF-to-MDS SSL
: Configures how CMF connects to the Confluent Platform Metadata Service (MDS) over HTTPS.
  These settings are part of the authorization configuration under
  `cmf.authorization.mdsRestConfig.authentication.config` and are completely
  separate from the server SSL settings. For details, see [Configure Authorization for Confluent Manager for Apache Flink](authorization.md#cmf-authorize).
  This context does not apply when using the CMF embedded MDS
  (`cmf.authorization.authority: cmf`), because CMF communicates with
  the embedded MDS over loopback. For details, see [Configure Embedded MDS for Confluent Manager for Apache Flink](embedded-mds.md#cmf-embedded-mds).

`cmf.authentication.*` — Client authentication
: Configures how CMF identifies the client principal from incoming requests.
  For mTLS, this extracts the principal from the client certificate. For OAuth,
  this validates the bearer token. Authentication is independent of the
  transport-level SSL configuration.

## mTLS authentication

mTLS provides two-way authentication to ensure that traffic between clients and the CMF node
is secure, and that content from both directions can be trusted.
For a review of mTLS and RBAC terminology, see [mutual TLS (mTLS) authentication](/platform/current/security/authentication/mutual-tls/overview.html).

CMF maps either the certificate’s Subject Distinguished Name (DN) or a
Subject Alternative Name (SAN) URI to a principal using
`auth.ssl.principal.mapping.rules`. For details on SAN URI mapping, see
[SAN URI principal mapping](/platform/current/security/authentication/mutual-tls/tls-principal-mapping.html#tls-principal-mapping-san-uri-components).

## Example

The following configuration file shows how to provision Confluent Manager for Apache Flink with a keystore and truststore
to specify mTLS for all communication. It also shows how to configure a
mounted volume to store certificates. You pass the configuration file to Helm when you install CMF.

```yaml
# mtls-values.yaml
  cmf:
    # Server SSL/TLS: Configures HTTPS for incoming client connections to |cmf|.
    # These settings map to Spring Boot server.ssl.* properties.
    ssl:
      keystore: /store/my-keystore
      keystore-password: #Optional in case the key store is password protected
      trust-store: /store/my-trust-store
      trust-store-password: #Optional in case the trust store is password protected
      client-auth: need # require clients to present a valid certificate
    # Authentication: Configures how |cmf| identifies the client principal
    # from the client certificate presented during the mTLS handshake.
    authentication:
      type: mtls
      config:
        auth.ssl.principal.mapping.rules: #Optional to extract a specific principal from the certificate https://docs.confluent.io/platform/current/security/authentication/mutual-tls/tls-principal-mapping.html
  # Example to mount the certificate stores into your installation
  mountedVolumes:
    volumes:
      - name: certificates
        azureFile:
          secretName: azure-secret
          shareName: aksshare
          readOnly: true
    volumeMounts:
      - name: certificates
        mountPath: /store
```

When you make the `helm install` call, use the `-f` flag to pass the YAML file with the security information
like the following:

```bash
helm upgrade --install cmf confluentinc/confluent-manager-for-apache-flink \
-f mtls-values.yaml
```

## OAuth authentication

#### IMPORTANT
OAuth is available in Confluent Platform version 7.9 and later. To connect Confluent for Kubernetes to
CMF with OAuth, set the authentication `type` to `oauth` in the
`CMFRestClass` resource.

Starting with Confluent Platform version 7.9, the CMF server can be configured for Open Authentication (OAuth) to secure its services.

## Example

The following configuration file shows how to provision Confluent Manager for Apache Flink with OAuth authentication.

```yaml
# oauth-values.yaml
  cmf:
    # Optional: Uncomment to enable HTTPS for incoming client connections
    # to the |cmf| server. This is independent of OAuth authentication.
    # ssl:
    #   keystore: /store/my-keystore
    #   keystore-password: #password if the keystore is password protected
    #   trust-store: /store/my-trust-store
    #   trust-store-password: #password if the truststore is password protected
    # Authentication: Configures how |cmf| validates OAuth bearer tokens
    # from incoming client requests.
    authentication:
      type: oauth
      config:
        # OAuth token validation settings
        oauthbearer.jwks.endpoint.url: <jwks-endpoint-url>
        token.issuer: Confluent
        oauthbearer.expected.issuer: <idp-issuer-url>
        oauthbearer.sub.claim.name: <sub-claim-name>
        oauthbearer.groups.claim.name: <groups-claim-name>
        oauthbearer.expected.audience: <audience>
        # MDS connectivity settings for authorization and token validation.
        # These configure how |cmf| connects to the Metadata Service (MDS).
        public.key.path: /path/to/metadata-public-key
        confluent.metadata.bootstrap.server.urls: <mds-url>:<mds-port>
        confluent.metadata.http.auth.credentials.provider: OAUTHBEARER
        confluent.metadata.oauthbearer.token.endpoint.url: <idp-token-url>
        confluent.metadata.oauthbearer.login.client.id: <client-id-for-cmf>
        confluent.metadata.oauthbearer.login.client.secret: <client-secret-for-cmf>
        # Required when MDS uses HTTPS: truststore to trust the MDS
        # server certificate.
        confluent.metadata.ssl.truststore.location: /path/to/mds-truststore
        confluent.metadata.ssl.truststore.password: <truststore-password>
    # Required with OAuth: comma-separated list of the OAuth URLs that
    # CMF is allowed to call, such as the token and JWKS endpoints.
    kafka:
      oauthbearerAllowedUrls: "<idp-token-url>,<jwks-endpoint-url>"
```

## Related content

- [How to Secure a Flink Job with Confluent Manager for Apache Flink](../jobs/configure/security.md#cpf-security)