Chapter 2. Enhancements

For an overview of the enhancements introduced with Kafka 2.5.0, refer to the Kafka 2.5.0 Release Notes.

New configuration options make it possible to integrate with a wider set of authorization servers.

Depending on how you apply OAuth 2.0 authentication, and the type of authorization server, there are additional (optional) configuration settings you can use.

listener.name.client.oauthbearer.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
  # ...
  oauth.check.issuer=false \ 

  oauth.fallback.username.claim="CLIENT-ID" \ 

  oauth.fallback.username.prefix="CLIENT-ACCOUNT" \ 

  oauth.valid.token.type="bearer" \ 

  oauth.userinfo.endpoint.uri="https:://AUTH-SERVER-ADDRESS/userinfo" ; 

# ...
System.setProperty(ClientConfig.OAUTH_SCOPE, "SCOPE-VALUE") 

See Configuring OAuth 2.0 support for Kafka brokers and Configuring Kafka Java clients to use OAuth 2.0.

You can now enable and define access control for the Kafka Bridge through Cross-Origin Resource Sharing (CORS). CORS is a HTTP mechanism that allows browser access to selected resources from more than one origin. To configure CORS, you define a list of allowed resource origins and HTTP methods to access them. Additional HTTP headers in requests describe the origins that are permitted access to the Kafka cluster.

http.enabled=true
http.host=0.0.0.0
http.port=8080
http.cors.enabled=true 

http.cors.allowedOrigins=https://strimzi.io 

http.cors.allowedMethods=GET,POST,PUT,DELETE,OPTIONS,PATCH 

See Kafka Bridge HTTP configuration.