<a id="configure-sr-for-oauth"></a>

# Configure Confluent Schema Registry for OAuth Authentication in Confluent Platform

## Configure Schema Registry to connect to Confluent Server brokers

To configure Schema Registry to connect to Confluent Server brokers, add the following configuration settings to
the `schema-registry.properties`  file, replacing the placeholder values with your actual
configuration values:

```properties
kafkastore.bootstrap.servers=SASL_SSL://<broker>:9095
kafkastore.sasl.mechanism=OAUTHBEARER
kafkastore.security.protocol=SASL_SSL
kafkastore.sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginCallbackHandler
kafkastore.sasl.oauthbearer.token.endpoint.url=<token-endpoint-url>
kafkastore.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
    clientId="<client-id>" \
    clientSecret="<client-secret>" \
    scope="groups";
```

## Configure Confluent Server brokers to connect to Schema Registry

If broker-side validation is enabled on topics, Confluent Server brokers try to connect to
Schema Registry. Add the following configuration to the Confluent Server broker `server.properties`
file to enable this connection. If role-based access control (RBAC) is enabled, the principal defined
here should have appropriate permissions. For details, see [Validate Broker-side Schemas IDs in Confluent Platform](../../../schema-registry/schema-validation.md#schema-validation).

```properties
# Schema registry configurations.
confluent.schema.registry.url=<sr-url>
# If Broker validation is enabled for topics
confluent.bearer.auth.credentials.source=OAUTHBEARER
confluent.bearer.auth.issuer.endpoint.url=<token-endpoint-url>
confluent.bearer.auth.client.id=<client-id>
confluent.bearer.auth.client.secret=<client-secret>
```

## Configure Schema Registry to connect to Metadata Service (MDS)

To configure your Schema Registry to connect to your Metadata Service (MDS), add the following settings
to the `schema-registry.properties` file, replacing the placeholder values with your actual
configuration values.

```properties
confluent.metadata.bootstrap.server.urls=http://<mds-url>:<mds-port>
confluent.metadata.http.auth.credentials.provider=OAUTHBEARER
confluent.metadata.oauthbearer.token.endpoint.url=http://<idp-url>
confluent.metadata.oauthbearer.login.client.id=<client-id>
confluent.metadata.oauthbearer.login.client.secret=<client-secret>
```

## Configure Schema Registry to use OAuth authentication

To enable OAuth on your Schema Registry, add the following settings to the `server.properties`
file, replacing the placeholder values with your actual configuration values.

```properties
rest.servlet.initializor.classes=io.confluent.common.security.jetty.initializer.AuthenticationHandler
oauthbearer.jwks.endpoint.url=<jwks-endpoint-url>
oauthbearer.expected.issuer=<idp-issuer-url>
oauthbearer.expected.audience=<audience>
oauthbearer.sub.claim.name=<sub-claim-name>
oauthbearer.groups.claim.name=<groups-claim-name>
```

## Configure Schema Registry clients to use OAuth authentication

The Schema Registry client can have explicit configurations to communicate with the Schema Registry
server over OAuth.

```properties
bearer.auth.credentials.source=OAUTHBEARER
bearer.auth.issuer.endpoint.url=<idp-token-endpoint>
bearer.auth.client.id=<client-id>
bearer.auth.client.secret=<client-secret>
bearer.auth.scope=<scope>
```

Alternatively, a Schema Registry client can reuse the configurations to connect to the
Confluent Server broker. The properties related to the endpoint and client are inherited
from the Kafka client and are optional. However, if provided, the properties
take higher precedence.

```properties
bearer.auth.credentials.source=SASL_OAUTHBEARER_INHERIT
# Configs below would be optional
bearer.auth.issuer.endpoint.url=<idp-token-endpoint>
bearer.auth.client.id=<client-id>
bearer.auth.client.secret=<client-secret>
bearer.auth.scope=<scope>
```

For Kafka Java clients supporting SASL OAUTHBEARER, allow specific IdP endpoints by setting the following configuration property:

```properties
org.apache.kafka.sasl.oauthbearer.allowed.urls=<idp_jwks_url>,<idp_token_url>,...
```

This property specifies a comma-separated list of allowed IdP JWKS (JSON Web Key
Set) and token endpoint URLs. Use \* (asterisk) as the value to allow any endpoint.

```properties
org.apache.kafka.sasl.oauthbearer.allowed.urls=*
```

You should consult the specific Kafka client and IdP documentation for the
exact interpretation and security implications of such a broad setting.

Java applications should set this property as a JVM system property when
launching the application:

```bash
-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls=<idp_jwks_url>,<idp_token_url>,...
```

For other clients (for example, Python, Go, .NET) that are built on
librdkafka, these clients use different property names and configuration
mechanisms. So, refer to specific client library documentation for the
equivalent OAuthBEARER configuration properties.

## Related content

* [Configure Truststores for TLS Handshake with Identity Providers](configure-truststore.md#configure-truststore-for-oauth)
* [Use OAuth/OIDC for Authentication in Confluent Platform](overview.md#oauth-oidc-authentication-overview)
* [Use SASL/OAUTHBEARER Authentication Between Confluent Server Brokers and Kafka Clients in Confluent Platform](../sasl/oauthbearer/overview.md#sasl-oauthbearer-authentication-overview)
* [Passwordless Authentication for Confluent Server and Schema Registry](../../../schema-registry/security/passwordless-auth.md#passwordless-auth)