Strimzi Operator OAuth Listener with unsecuredLoginStringClaim_sub parameter.

[rfarajro]

Hi,

We need configure in a listener the parameter called "unsecuredLoginStringClaim_sub" with value "unused", by defaul, strimzi operator configure this value as "thePrincipalName", but I haven't been able to find anything in the documentation (https://strimzi.io/docs/operators/in-development/configuring.html#type-KafkaListenerAuthenticationOAuth-reference) how to define this parameter using type: oauth. Type: Custom does not work with our configuration, so, we can't use it.

Please, any idea? Here are our listener configuration:

  - name: external
    port: 9094
    type: nodeport
    tls: true
    authentication:
      type: oauth
      validIssuerUri: https://...
      jwksEndpointUri: https://...
      clientId: XXXXXxxxxXXXX
      checkAudience: true
      checkAccessTokenType: false
      userNameClaim: sub

Thanks and regards.

[scholzj]

If the option does not exist in the API, you cannot configure it. It might also help if you explain the use-case properly - that might help to understand why should it be configurable.

[rfarajro]

Hi,

Thanks for answering. The reason why we need to configure that parameter in the kafka cluster deployed in Kubernetes is because the development team has passed us the configuration of a kafka environment that has not been deployed in a kubernetes cluster to authenticate with the identity server. It seems that it is a necessary parameter.

Thanks and regards.

[scholzj]

It is normal that different Kafka clusters use different configurations. So I think it is important to understand why is this parameter needed. The README.md in https://github.com/strimzi/strimzi-kafka-oauth for example suggests it is needed to be set to something else only for inter-broker listeners which is not the case here.

[rfarajro]

Thanks, whit this configuration, clients are getting the below error:

no principal name in jwt claim sub.

Regards.

[scholzj]

@mstruk Any ideas?

[rfarajro]

Hi,

Thanks for your time, my problem was solved, the developer team send me a wrong data. Now the authentications works.

Regards.

[mstruk]

AFAIK that parameter is used when SASL_LOGIN_CALLBACK_HANDLER_CLASS is not set on the broker listener (which mostly it is not because it would only be used for inter-broker communication). Unless unsecuredLoginStringClaim_sub is set the default implementation of SaslLoginCallbackHandler while performing some validation checks, throws an exception.
In Strimzi operator we take care of this behind the scene, so no need to explicitly configure it.