<a id="configure-c3-for-oauth"></a>

# Configure Confluent Control Center for OAuth Authentication in Confluent Platform

Use the following configurations to secure and authenticate Confluent Control Center within your
Confluent Platform deployments.

## Configure Confluent Control Center as Metadata Service (MDS) OAuth client

To configure Confluent Control Center to get OAuth authentication tokens, add the following configuration
settings, replacing `<url>`, `<client-id>`, and `<client-secret>` with your actual
values:

```properties
confluent.metadata.oauthbearer.token.endpoint.url=<url>
confluent.metadata.oauthbearer.login.client.id=<client-id>
confluent.metadata.oauthbearer.login.client.secret=<client-secret>
```

These are the minimal configurations that are required.

For interactions between Confluent Control Center and your identity provider, you can add the following
optional configuration settings:

```properties
confluent.metadata.oauthbearer.login.connect.timeout.ms
confluent.metadata.oauthbearer.login.read.timeout.ms
confluent.metadata.oauthbearer.login.retry.backoff.max.ms
confluent.metadata.oauthbearer.login.retry.backoff.ms
```

## Confluent Control Center as a Kafka client

When using Confluent Control Center as a Kafka client, you need to configure it with the appropriate
settings to ensure secure and authenticated communication with your Confluent Platform
clusters.

To enable OAuth authentication for the Confluent Control Center client, follow these steps:

1. Specify the SASL mechanism as `OAUTHBEARER`.
   ```properties
   confluent.controlcenter.kafka.sasl.mechanism=OAUTHBEARER
   ```
2. Add the JAAS configuration with your specific client credentials and scope,
   replacing `<client-id>`, `<client-secret>`, and `<scope>` with your actual
   values.
   ```properties
   confluent.controlcenter.kafka.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
     clientId="<client-id>" \
     clientSecret="<client-secret>" \
     scope="<scope>";
   ```

## Related content

* [Configure Truststores for TLS Handshake with Identity Providers](configure-truststore.md#configure-truststore-for-oauth)
* [Use OAuth/OIDC for Authentication in Confluent Platform](overview.md#oauth-oidc-authentication-overview)
* [Use SASL/OAUTHBEARER Authentication Between Confluent Server Brokers and Kafka Clients in Confluent Platform](../sasl/oauthbearer/overview.md#sasl-oauthbearer-authentication-overview)