Configure Confluent Control Center (Legacy) for OAuth Authentication in Confluent Platform

Use the following configurations to secure and authenticate Confluent Control Center (Legacy) within your Confluent Platform deployments.

Configure Confluent Control Center (Legacy) as MDS OAuth client

To configure Confluent Control Center (Legacy) to get OAuth authentication tokens, add the following configuration settings, replacing <url>, <client-id>, and <client-secret> with your actual values:

confluent.metadata.oauthbearer.token.endpoint.url=<url>
confluent.metadata.oauthbearer.login.client.id=<client-id>
confluent.metadata.oauthbearer.login.client.secret=<client-secret>

These are the minimal configurations that are required.

For interactions between Confluent Control Center (Legacy) and your identity provider, you can add the following optional configuration settings:

confluent.metadata.oauthbearer.login.connect.timeout.ms
confluent.metadata.oauthbearer.login.read.timeout.ms
confluent.metadata.oauthbearer.login.retry.backoff.max.ms
confluent.metadata.oauthbearer.login.retry.backoff.ms

Confluent Control Center (Legacy) as a Kafka client

When using Confluent Control Center (Legacy) as a Kafka client, you need to configure it with the appropriate settings to ensure secure and authenticated communication with your Confluent Platform clusters.

To enable OAuth authentication for the Confluent Control Center (Legacy) client, follow these steps:

  1. Specify the SASL mechanism as OAUTHBEARER.

    confluent.controlcenter.kafka.sasl.mechanism=OAUTHBEARER

  2. Add the JAAS configuration with your specific client credentials and scope, replacing <client-id>, <client-secret>, and <scope> with your actual values.

    confluent.controlcenter.kafka.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
  clientId="<client-id>" \
  clientSecret="<client-secret>" \
  scope="<scope>";

Related content