How does Strimzi Oauth support mTLS(Client Authentication)

[navalgoyal]

How to configure mTLS in Strimzi Kafka OAuth..?? as per the documentation it can configure following properties:

"oauth.ssl.truststore.location"
"oauth.ssl.truststore.certificates"
"oauth.ssl.truststore.password"

How to configure keystore for client authentication?

[mstruk]

OAuth and mTLS are two unrelated and mutually exclusive authentication mechanisms.

If you use mTLS to authenticate your Kafka client to your Kafka cluster, you use the SSL security protocol. The authentication of the client using the client certificate occurs during the establishing of the TLS channel before the client even starts using the Kafka protocol to speak to the Kafka broker.

On the other hand, if you use OAuth you use the SASL_SSL security protocol, where there is no client certificate involved during the establishing of the TLS session, and the authentication of the client occurs via Kafka protocol where client requests OAUTHBEARER SASL mechanism to be used and establishes a session by sending an access token that the client obtained from the authorization server.

[scholzj]

@navalgoyal You should probably clarify what do you mean ... you want to use SASL OAUTHBERER over mTLS in Kafka clients when talking with Kafka brokers? Or do you want the Kafka broker/client to use mTLS when talking with the OAuth server (as that is what the oauth.ssl options do IIRC)?

[navalgoyal]

@scholzj we are using IAM(KeyCloak) as OAuth Server which has capability of mTLS (Truststore and keystore). how to use mTLS connecting with this OAuth server using mTLS?

[scholzj]

I do not think we support mTLS between the Oauth library and the OAuth server. Only regular TLS for encryption and server authentication.

[mstruk]

Right, we do not support client authentication via mTLS between OAuth library and the authorization server at this point.