open-telemetry · richscott · Jul 21, 2025 · Jul 21, 2025 · Jul 22, 2025 · Jul 22, 2025
@@ -0,0 +1,29 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: kafka
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: This change adds support for authentication via OIDC to the Kafka client.
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [41872]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  It provides an implementation of the sarama.AccessTokenProvider interface, supporting the
+  client_credentials Grant Type, and a background token refresh.
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []
@@ -125,6 +125,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.41.0 // indirect
 	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect

@@ -91,6 +91,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.41.0 // indirect
 	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect

@@ -7,10 +7,12 @@ import (
 	"context"
 	"crypto/sha256"
 	"crypto/sha512"
+	"time"
 
 	"github.com/IBM/sarama"
 	"github.com/aws/aws-msk-iam-sasl-signer-go/signer"
 
+	"github.com/open-telemetry/opentelemetry-collector-contrib/internal/kafka/oidc"
 	"github.com/open-telemetry/opentelemetry-collector-contrib/pkg/kafka/configkafka"
 )
 
@@ -57,6 +59,12 @@ func configureSASL(ctx context.Context, config configkafka.SASLConfig, saramaCon
 	case AWSMSKIAMOAUTHBEARER:
 		saramaConfig.Net.SASL.Mechanism = sarama.SASLTypeOAuth
 		saramaConfig.Net.SASL.TokenProvider = &awsMSKTokenProvider{ctx: ctx, region: config.AWSMSK.Region}
+	case OIDCFILE:
+		saramaConfig.Net.SASL.Mechanism = sarama.SASLTypeOAuth
+		saramaConfig.Net.SASL.TokenProvider, _ = oidc.NewOIDCfileTokenProvider(ctx, saramaConfig.ClientID,
+			config.OIDCFILE.ClientSecretFilePath, config.OIDCFILE.TokenURL,
+			config.OIDCFILE.Scopes, time.Duration(config.OIDCFILE.RefreshAheadSecs)*time.Second,
+			config.OIDCFILE.EndPointParams, config.OIDCFILE.AuthStyle)
 	}
 }
 

@@ -4,11 +4,15 @@
 package kafka
 
 import (
+	"net/url"
 	"testing"
+	"time"
 
 	"github.com/IBM/sarama"
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/oauth2"
 
+	"github.com/open-telemetry/opentelemetry-collector-contrib/internal/kafka/oidc"
 	"github.com/open-telemetry/opentelemetry-collector-contrib/pkg/kafka/configkafka"
 )
 
@@ -51,6 +55,16 @@ func TestAuthentication(t *testing.T) {
 		region: "region",
 	}
 
+	saramaSASLOIDCFILEConfig := &sarama.Config{}
+	saramaSASLOIDCFILEConfig.Net.SASL.Enable = true
+	saramaSASLOIDCFILEConfig.Net.SASL.Mechanism = sarama.SASLTypeOAuth
+	// Specify 0 seconds for the RefreshAhead, as we don't want to have it launch
+	// the background refresher goroutine - we are just verifying authentication
+	// configuration setup here.
+	saramaSASLOIDCFILEConfig.Net.SASL.TokenProvider, _ = oidc.NewOIDCfileTokenProvider(
+		t.Context(), saramaSASLOIDCFILEConfig.ClientID, "/etc/hosts", "http://127.0.0.1:3000/oidc",
+		[]string{"mock-scope"}, time.Duration(0)*time.Second, url.Values{}, oauth2.AuthStyleAutoDetect)
+
 	saramaKerberosCfg := &sarama.Config{}
 	saramaKerberosCfg.Net.SASL.Mechanism = sarama.SASLTypeGSSAPI
 	saramaKerberosCfg.Net.SASL.Enable = true
@@ -138,6 +152,22 @@ func TestAuthentication(t *testing.T) {
 			},
 			saramaConfig: saramaSASLAWSIAMOAUTHConfig,
 		},
+		{
+			auth: configkafka.AuthenticationConfig{
+				SASL: &configkafka.SASLConfig{
+					Mechanism: "OIDCFILE",
+					OIDCFILE: configkafka.OIDCFileConfig{
+						ClientSecretFilePath: "/etc/hosts",
+						TokenURL:             "http://127.0.0.1:3000/oidc",
+						Scopes:               []string{"mock-scope"},
+						RefreshAheadSecs:     0,
+						EndPointParams:       url.Values{},
+						AuthStyle:            oauth2.AuthStyleAutoDetect,
+					},
+				},
+			},
+			saramaConfig: saramaSASLOIDCFILEConfig,
+		},
 	}
 	for _, test := range tests {
 		t.Run("", func(t *testing.T) {
@@ -146,6 +176,14 @@ func TestAuthentication(t *testing.T) {
 
 			// equalizes SCRAMClientGeneratorFunc to do assertion with the same reference.
 			config.Net.SASL.SCRAMClientGeneratorFunc = test.saramaConfig.Net.SASL.SCRAMClientGeneratorFunc
+
+			// For OIDC token provider, we need to compare fields individually since the context
+			// contains non-deterministic channels that will cause the comparison to fail
+			if config.Net.SASL.TokenProvider != nil && test.saramaConfig.Net.SASL.TokenProvider != nil {
+				// Set them to the same reference for comparison
+				config.Net.SASL.TokenProvider = test.saramaConfig.Net.SASL.TokenProvider
+			}
+
 			assert.Equal(t, test.saramaConfig, config)
 		})
 	}

@@ -143,7 +143,7 @@
 	if tlsConfig == nil {
 		tlsConfig = config.Authentication.TLS
 	}
 	if tlsConfig != nil {
 		if tlsConfig, err := tlsConfig.LoadTLSConfig(ctx); err != nil {
 			return nil, err
 		} else if tlsConfig != nil {
@@ -153,6 +153,8 @@
 	} else if config.Authentication.SASL != nil && config.Authentication.SASL.Mechanism == "AWS_MSK_IAM_OAUTHBEARER" {
 		saramaConfig.Net.TLS.Config = &tls.Config{}
 		saramaConfig.Net.TLS.Enable = true
+	} else if config.Authentication.SASL != nil && config.Authentication.SASL.Mechanism == OIDCFILE {
+		saramaConfig.Net.TLS.Enable = true
 	}
 	configureSaramaAuthentication(ctx, config.Authentication, saramaConfig)
 	return saramaConfig, nil

@@ -32,6 +32,7 @@ const (
 	SCRAMSHA256          = "SCRAM-SHA-256"
 	PLAIN                = "PLAIN"
 	AWSMSKIAMOAUTHBEARER = "AWS_MSK_IAM_OAUTHBEARER" //nolint:gosec // These aren't credentials.
+	OIDCFILE             = "OIDCFILE"
 )
 
 // NewFranzSyncProducer creates a new Kafka client using the franz-go library.

@@ -5,6 +5,8 @@ go 1.24.0
 require (
 	github.com/IBM/sarama v1.46.0
 	github.com/aws/aws-msk-iam-sasl-signer-go v1.0.4
+	github.com/golang-jwt/jwt/v5 v5.2.0
+	github.com/google/uuid v1.6.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/pkg/kafka/configkafka v0.135.0
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9
 	github.com/stretchr/testify v1.11.1
@@ -15,6 +17,7 @@ require (
 	go.opentelemetry.io/collector/config/configopaque v1.41.1-0.20250911155607-37a3ace6274c
 	go.opentelemetry.io/collector/config/configtls v1.41.1-0.20250911155607-37a3ace6274c
 	go.uber.org/goleak v1.3.0
+	golang.org/x/oauth2 v0.30.0
 )
 
 require (