Skip to content

[improve][client] Implement tls_client_auth for AuthOauth2 #575

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
izumo27 wants to merge 3 commits into
base: main
Choose a base branch
from
+613 −112
Open

[improve][client] Implement tls_client_auth for AuthOauth2 #575

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e92333a
implement tls_client_auth
Apr 27, 2026
572e199
explicitly specify default authMethod
May 8, 2026
3f899fb
fix lint
May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion include/pulsar/Authentication.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -515,11 +515,22 @@ typedef std::shared_ptr<CachedToken> CachedTokenPtr;
* Passed in parameter would be like:
* ```
* "type": "client_credentials",
* "tokenEndpointAuthMethod": "client_secret_post",
* "issuer_url": "https://accounts.google.com",
* "client_id": "d9ZyX97q1ef8Cr81WHVC4hFQ64vSlDK3",
* "client_secret": "on1uJ...k6F6R",
Comment on lines 520 to 521
* "audience": "https://broker.example.com"
* ```
*
* For `tokenEndpointAuthMethod = "tls_client_auth"`:
* ```
* "type": "client_credentials",
* "tokenEndpointAuthMethod": "tls_client_auth",
* "issuer_url": "https://accounts.google.com",
* "client_id": "d9ZyX97q1ef8Cr81WHVC4hFQ64vSlDK3",
* "tls_cert_file": "/path/to/cert.pem",
* "tls_key_file": "/path/to/key.pem"
* ```
* If passed in as std::string, it should be in Json format.
*/
class PULSAR_PUBLIC AuthOauth2 : public Authentication {
Expand All @@ -530,7 +541,14 @@ class PULSAR_PUBLIC AuthOauth2 : public Authentication {
/**
* Create an AuthOauth2 with a ParamMap
*
* The required parameter keys are “issuer_url”, “private_key”, and “audience”
* For `tokenEndpointAuthMethod = "client_secret_post"` (default), the required parameter
* keys are “issuer_url”, “private_key”, and “audience”.
* Optional keys: `scope`, `tls_cert_file`, `tls_key_file`.
Comment on lines +544 to +546
Copy link
Copy Markdown
Contributor Author

@izumo27 izumo27 May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Although the RFC defines audience as an optional parameter, it remains required for client_secret_post to avoid a breaking change.

*
* For `tokenEndpointAuthMethod = "tls_client_auth"`, the required parameter keys are
* `issuer_url`, `tls_cert_file`, and `tls_key_file`.
* Optional keys: `client_id`, `audience`, `scope`. If `client_id` is omitted, the client
* uses `pulsar-client`.
*
* @param parameters the key-value to create OAuth 2.0 client credentials
* @see http://pulsar.apache.org/docs/en/security-oauth2/#client-credentials
Expand Down
Loading