# Configure Metadata Service (MDS) for OAuth Authentication in Confluent Platform Use the following configurations for Metadata Service (MDS) to support OAuth authentication in your Confluent Platform clusters. ## Configure MDS to support OAuth The required configuration settings for OAuth on MDS are as follows. These settings are necessary to enable IdP-issued OAuth token validation in MDS. Replace the placeholder values with your actual configuration values. ```properties confluent.metadata.server.oauthbearer.jwks.endpoint.url= confluent.metadata.server.oauthbearer.expected.issuer= confluent.metadata.server.oauthbearer.expected.audience=Confluent,api://default,https://my-company.com confluent.metadata.server.oauthbearer.sub.claim.name=sub confluent.metadata.server.oauthbearer.groups.claim.name=groups ``` If your identity provider uses self-signed certificates for SSL, the truststore for verifying certs can be configured using Metadata Service (MDS) configuration settings. ### Configure MDS to enable OAuth without LDAP In this case, HTTP Basic authentication (username:password) is not supported. To interact with MDS, you must use a token from your identity provider or a Confluent-issued token. ```properties confluent.metadata.server.user.store=OAUTH ``` ### Configure MDS to enable OAuth with LDAP This configuration adds OAuth support without removing LDAP. This is useful for client migration scenarios and should be replaced after migration. ```properties confluent.metadata.server.user.store=LDAP_WITH_OAUTH ``` ### Configure MDS for CLI SSO The configurations for CLI SSO are an extension of C3 SSO with one extra configuration. Add the following configuration property, replacing `` with your actual value: ```properties confluent.oidc.idp.device.authorization.endpoint.uri= ``` ## Configure MDS clients MDS clients (like Confluent Control Center, Schema Registry, and Connect) use this flow for connecting to MDS. The client first gets a JWT from the identity provider. A sample curl request to get the token from the identity provider is: ```shell curl -X POST \ -H "Authorization: Basic " \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials" \ -d "scope=groups" \ ``` After receiving the token, the client needs to include the token as `Authorization` when calling MDS. Assuming MDS is running on port `8090` on `localhost`, the following request should succeed: ```shell curl -X GET "http://localhost:8090/security/1.0/roles" \ -H "accept: application/json" \ -H "Authorization: Bearer " ``` ## Related content * [Passwordless Authentication for Confluent Server and Schema Registry](../../../schema-registry/security/passwordless-auth.md#passwordless-auth) * [Metadata Service Configuration Settings](../../../kafka/configure-mds/mds-configuration.md#mds-configuration-options) * [Use OAuth/OIDC for Authentication in Confluent Platform](overview.md#oauth-oidc-authentication-overview) * [Use SASL/OAUTHBEARER Authentication Between Confluent Server Brokers and Kafka Clients in Confluent Platform](../sasl/oauthbearer/overview.md#sasl-oauthbearer-authentication-overview)