confluent-kafka-python icon indicating copy to clipboard operation
confluent-kafka-python copied to clipboard

Update registry rest client to support bearer authentication

Open gtato opened this issue 1 year ago • 2 comments

This change allows schema registry clients to specify a token in case the registry server supports token/oidc authentication.

gtato avatar Mar 09 '24 21:03 gtato

CLA assistant check
All committers have signed the CLA.

cla-assistant[bot] avatar Mar 09 '24 21:03 cla-assistant[bot]

When using Bearer auth from curl, we needed to provide additional headers for Confluent-Identity-Pool-Id and target-sr-cluster. Have you succeeded in using this branch to connect?

Additionally, needing to recreate the client whenever a token refresh is needed is cumbersome. Inserting a user-provided token-fetching callback as part of a custom auth for the Requests Session may be a more user-friendly option. A custom auth could look something like:

class BearerAuth(requests.auth.AuthBase):
    def __init__(self, token_cb):
        self.token_cb = token_cb

    def __call__(self, request):
        """Called directly by requests to add the Authorization header"""
        token = token_cb()
        request.headers["Authorization"] = f"Bearer {token}"
        return request

and you can hook this in by setting self.session.auth = BearerAuth(token_cb).

iamed2 avatar Aug 14 '24 19:08 iamed2