Add azure_federated authentication to Kafka source#7011
Open
bagmarnikhil wants to merge 2 commits into
Open
Conversation
bagmarnikhil
requested review from
KarstenSchnitter,
Zhangxunmt,
dinujoh,
divbok,
dlvenable,
graytaylor0,
kkondaka,
oeyh,
san81,
sb2k16,
srikanthjg and
srikanthpadakanti
as code owners
July 20, 2026 15:55
✅ License Header Check PassedAll newly added files have proper license headers. Great work! 🎉 |
Enable the Kafka source to consume from Azure Event Hubs by federating an AWS identity to Azure Active Directory for OAuth, so no Azure client secret is stored in the pipeline. Credentials use Data Prepper's standard AWS configuration, so one pipeline works across AWS credential setups. Signed-off-by: Nikhil Bagmar <nikhilbagmar73@gmail.com>
bagmarnikhil
force-pushed
the
feature/kafka-azure-federated-oauthbearer
branch
from
July 20, 2026 15:58
34f4230 to
8ecc90d
Compare
kiran536
reviewed
Jul 20, 2026
- AzureFederatedTokenProvider now exposes close() (lock-guarded) and AzureFederatedCallbackHandler.close() delegates to it, releasing the lazily-created StsClient on shutdown instead of leaking it. - Promote the OPT_* JAAS option keys on AzureFederatedCallbackHandler to public and reference them from KafkaSecurityConfigurer so the writer and reader share one definition and can't drift. - Replace the repeated "SASL_SSL" literals in KafkaSecurityConfigurer with a SASL_SSL_PROTOCOL constant. - Add unit tests for close() delegation and StsClient cleanup. Signed-off-by: Nikhil Bagmar <nikhilbagmar73@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Enables the Kafka source to consume from Azure Event Hubs by federating an AWS identity to Azure Active Directory for OAuth, so no Azure client secret is stored in the pipeline. At runtime the source resolves AWS credentials through Data Prepper's standard AWS configuration, obtains an AWS web-identity token and exchanges it at the Azure Entra token endpoint for a short-lived access token used as the SASL/OAUTHBEARER credential. Credentials use Data Prepper's standard AWS configuration, so one pipeline works across AWS credential setups.
Issues Resolved
Resolves #7007
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.