# Configure OAuth for Schema Registry in Confluent Platform Configure the Schema Registry server to use OAuth to secure its services. The following sections cover the OAuth configurations for the Kafka broker, Schema Registry server, and Schema Registry clients, depending on your use case. ## Configure the Kafka broker to connect to Schema Registry In cases where [broker-side schema validation](../schema-validation.md#schema-validation) is enabled on topics, the Kafka Broker attempts to connect to Schema Registry. Provide the following configurations in the broker properties file to allow the broker to connect to Schema Registry for validation. For example, if using [KRaft](../../kafka-metadata/kraft.md#kraft-overview), you would configure this in one of `$CONFLUENT_HOME/etc/kafka/broker.properties`, `controller.properties`, or `server.properties`, depending on your [KRaft setup](../../kafka-metadata/config-kraft.md#kraft-config-options). If role-based access control (RBAC) is enabled, the principal defined here should have appropriate permissions. ```bash # Schema registry configurations confluent.schema.registry.url= # If Broker validation is enabled for topics confluent.bearer.auth.credentials.source=OAUTHBEARER confluent.bearer.auth.issuer.endpoint.url= confluent.bearer.auth.client.id= confluent.bearer.auth.client.secret= ``` ## Enable OAuth on the Schema Registry server Configure the following properties in the Schema Registry properties file to specify OAuth requirements for clients connecting to the Schema Registry server (for example, `$CONFLUENT_HOME/etc/schema-registry/schema-registry.properties`). ```bash rest.servlet.initializor.classes=io.confluent.common.security.jetty.initializer.AuthenticationHandler oauthbearer.jwks.endpoint.url=https://my-good-idp.com/oauth2/keys oauthbearer.expected.issuer= oauthbearer.expected.audience= oauthbearer.sub.claim.name= oauthbearer.groups.claim.name= ``` ## Configure OAuth on the Schema Registry client If OAuth is enabled on the Schema Registry server, Schema Registry clients must be configured appropriately. In Confluent Platform 7.7 and newer versions, the Schema Registry can be configured for OAuth as well as LDAP. Therefore, the Schema Registry can support scenarios where one Schema Registry client uses LDAP Basic Authentication to connect to Schema Registry whereas another client might use the OAuth configurations and workflow to connect to same Schema Registry server. Schema Registry clients can have an explicit configuration to talk to Schema Registry server over OAuth, as shown in this example. ```bash bearer.auth.credentials.source=OAUTHBEARER bearer.auth.issuer.endpoint.url= bearer.auth.client.id= bearer.auth.client.secret= bearer.auth.scope= ``` Alternatively, a Schema Registry client can reuse the configurations used to connect to Kafka broker. In this case, the properties related to “endpoint” and “client” are inherited from the Kafka client and are optional. However, if the properties are provided in the client configuration, they take higher precedence. ```bash bearer.auth.credentials.source=SASL_OAUTHBEARER_INHERIT # Configs below are optional bearer.auth.issuer.endpoint.url= bearer.auth.client.id= bearer.auth.client.secret= bearer.auth.scope= ``` For details on each of these configuration options, see the [Configuration Reference for Schema Registry Clients on Confluent Platform](../sr-client-configs.md#sr-client-configs). To learn more about configuring clients with Basic Authentication, see [Schema Registry](../../security/authentication/http-basic-auth/overview.md#basic-auth-sr) in the Security documentation for authenticating using HTTP Basic Authentication. ## Related content - [Authentication in Confluent Platform](../../security/authentication/overview.md#authentication-overview) - [Configuration Reference for Schema Registry Clients on Confluent Platform](../sr-client-configs.md#sr-client-configs)