Document kafka.sasl.oauth.tokenFilepath
#1157
Conversation
✅ Deploy Preview for redpanda-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
|
||
| [NOTE] | ||
| ==== | ||
| When using OIDC with static credentials, Redpanda Console authenticates to Redpanda as the OIDC client itself (usually a service principal). In this case, Redpanda evaluates access based on the `sub` claim in the token. Be sure to set `oidc_principal_mapping: "$.sub"` in your Redpanda configuration and grant ACLs for that value. For detailed steps to create ACLs, see xref:manage:security/authorization/acl.adoc[] |
There was a problem hiding this comment.
Be sure to set
oidc_principal_mapping: "$.sub"in your Redpanda configuration
Isn't this the default in Redpanda already?
| clientId: "<oidc-client-id>" # <1> | ||
| clientSecret: "<oidc-client-secret>" # <2> | ||
| tokenEndpoint: "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token" # <3> | ||
| scope: "api://<oidc-client-id>/.default" # <4> |
There was a problem hiding this comment.
For completeness: The principalMapping option should be added either in this or the other PR
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the 📝 WalkthroughWalkthroughThe documentation for Redpanda Console authentication was reorganized and clarified. The distinction between "runtime acquisition mode" and "static token mode" for OIDC authentication was removed in favor of a unified explanation. Example configurations for various authentication methods—including user impersonation, SCRAM, and multiple static OIDC token provisioning scenarios—were expanded and reorganized with detailed comments. Notes on secret management and access control were updated. A new commented example line for specifying a token file path was added to the shared configuration YAML. No changes were made to code or exported entities. Sequence Diagram(s)sequenceDiagram
participant User
participant Console
participant IdP
participant Kafka
User->>Console: Initiate authentication
Console->>IdP: Request JWT (if runtime acquisition)
IdP-->>Console: Return JWT
Console->>Kafka: Connect using JWT (or static token)
Kafka-->>Console: Authentication result
Console-->>User: Grant or deny access
Assessment against linked issues
Possibly related PRs
Suggested reviewers
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Co-authored-by: Martin Schneppenheim <23424570+weeco@users.noreply.github.com>
Co-authored-by: Michele Cyran <michele@redpanda.com>
Description
Resolves https://redpandadata.atlassian.net/browse/DOC-1304
Review deadline: June 12
This pull request updates the Redpanda Console documentation to provide detailed examples and guidance for configuring authentication with various methods, including user impersonation, static credentials, and OIDC. The changes enhance clarity, add new configuration options, and improve usability for administrators setting up secure access to Redpanda services.
Authentication Configuration Enhancements:
General Improvements:
tokenFilepathoption for Kubernetes environments.Page previews
Checks