# Configure Confluent REST Proxy for OAuth Authentication in Confluent Platform Confluent REST Proxy is a REST application built on Jetty, designed to facilitate communication with Kafka. It supports [OAuth authentication](overview.md#oauth-oidc-authentication-overview), allowing secure interactions with Confluent Server brokers and other Confluent Platform services. The configuration process for REST Proxy mirrors that of Schema Registry. ## Configure standalone REST Proxy To configure your standalone REST Proxy, use the following configuration information. ### Connect REST Proxy to Kafka To configure the REST Proxy to connect to Kafka, add the following properties to the REST Proxy configuration file, replacing the placeholder values with your actual configuration values: ```properties client.sasl.mechanism=OAUTHBEARER client.security.protocol=SASL_SSL client.sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginCallbackHandler client.sasl.oauthbearer.token.endpoint.url= client.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \ clientId="" \ clientSecret="" \ scope="groups"; ``` ### Configure REST Proxy connection to Metadata Service (MDS) To configure the REST Proxy to connect to the Metadata Service (MDS), add the following properties to the REST Proxy configuration file, replacing the placeholder values with your actual configuration values. ```properties confluent.metadata.oauthbearer.token.endpoint.url= confluent.metadata.oauthbearer.login.credentials.source=OAUTHBEARER confluent.metadata.oauthbearer.login.oauth.scope=groups confluent.metadata.bootstrap.server.urls= confluent.metadata.http.auth.credentials.provider=OAUTHBEARER confluent.metadata.oauthbearer.login.client.id= confluent.metadata.oauthbearer.login.client.secret= ``` ### Configure REST Proxy with OAuth To configure the REST Proxy server with OAuth, add the following properties to the REST Proxy configuration file, replacing the placeholder values with your actual configuration values. ```properties rest.servlet.initializor.classes=io.confluent.common.security.jetty.initializer.AuthenticationHandler # IdP settings oauthbearer.jwks.endpoint.url= oauthbearer.groups.claim.name=groups oauthbearer.sub.claim.name=sub oauthbearer.expected.audience=account oauthbearer.expected.issuer= ``` For Kafka Java clients supporting SASL OAUTHBEARER, allow specific IdP endpoints by setting the following configuration property: ```properties org.apache.kafka.sasl.oauthbearer.allowed.urls=,,... ``` This property specifies a comma-separated list of allowed IdP JWKS (JSON Web Key Set) and token endpoint URLs. Use \* (asterisk) as the value to allow any endpoint. ```properties org.apache.kafka.sasl.oauthbearer.allowed.urls=* ``` You should consult the specific Kafka client and IdP documentation for the exact interpretation and security implications of such a broad setting. Java applications should set this property as a JVM system property when launching the application: ```bash -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls=,,... ``` For other clients (for example, Python, Go, .NET) that are built on librdkafka, these clients use different property names and configuration mechanisms. So, refer to specific client library documentation for the equivalent OAuthBEARER configuration properties. ### Configure REST clients There are no specific REST client configurations required. Any REST client (such as Postman or cURL) with an identity provider (IdP) bearer token can access the available REST endpoints. Here is a sample cURL call: ```bash curl --location 'http://localhost:8090/kafka/v3/clusters//topics' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer ' \ --data '' ``` ## Configure embedded REST Proxy The embedded REST Proxy runs with the Metadata Service (MDS) (same Jetty) as a Kafka plugin. It has the same configurations as the standalone one, except that the Kafka bootstrap URL is optional. ## Enable OAuth in Confluent REST Proxy To enable OAuth in Confluent REST Proxy, add the following properties to the REST Proxy configuration file, replacing the placeholder values with your actual configuration: ```properties kafka.rest.rest.servlet.initializor.classes=io.confluent.common.security.jetty.initializer.AuthenticationHandler kafka.rest.authentication.roles=** kafka.rest.oauthbearer.jwks.endpoint.url= kafka.rest.oauthbearer.groups.claim.name=groups kafka.rest.oauthbearer.sub.claim.name= kafka.rest.oauthbearer.expected.audience= kafka.rest.oauthbearer.expected.issuer= ``` ## With RBAC To configure REST Proxy with role-based access control (RBAC), add the following properties, replacing the placeholder values with your actual configuration: ```properties kafka.rest.bootstrap.servers= kafka.rest.client.security.protocol=SASL_SSL kafka.rest.confluent.metadata.bootstrap.server.urls= kafka.rest.confluent.metadata.oauthbearer.login.client.id= kafka.rest.confluent.metadata.oauthbearer.login.client.secret= kafka.rest.confluent.metadata.oauthbearer.token.endpoint.url= kafka.rest.public.key.path= kafka.rest.kafka.rest.resource.extension.class=io.confluent.kafkarest.security.KafkaRestSecurityResourceExtension ``` ## Related content * [Configure Truststores for TLS Handshake with Identity Providers](configure-truststore.md#configure-truststore-for-oauth) * [Use OAuth/OIDC for Authentication in Confluent Platform](overview.md#oauth-oidc-authentication-overview) * [Use SASL/OAUTHBEARER Authentication Between Confluent Server Brokers and Kafka Clients in Confluent Platform](../sasl/oauthbearer/overview.md#sasl-oauthbearer-authentication-overview)