Atlas Stream Processing Kafka JWT/OIDC authentication and IdP reachability
Parent: MongoDB Atlas Stream Processing · Published reference · snapshot 2026-10-31
↓ Facts as markdownall context files
Source-anchored research for Atlas Stream Processing Kafka JWT/OIDC authentication and IdP reachability. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- ASP supports authenticating to Apache Kafka brokers using OIDC with JSON Web Tokens. In the Connection Registry UI, select OAUTHBEARER as the Kafka SASL mechanism; this is the ASP Kafka connection surface. (high confidence) (verified as of 2026-10-31) [source]
- For OAUTHBEARER, ASP requires a token endpoint URL, client ID and client secret. In the documented Kafka Private Link payload, use authentication.mechanism="OAUTHBEARER", authentication.method="OIDC", authentication.tokenEndpointUrl, authentication.clientId and authentication.clientSecret, with security.protocol="SASL_SSL". The UI exposes the endpoint and credentials under OAUTHBEARER. (high confidence) (verified as of 2026-10-31) [source]
- When choosing the ASP token endpoint URL, use HTTPS: although the ASP UI documentation describes an HTTP(S) URI, OAuth 2.0 RFC 6749 section 3.2 requires TLS for token endpoint requests. Public reachability does not remove the token endpoint confidentiality requirement. (high confidence) [source]
- In the client-credentials exchange described by RFC 6749 section 4.4 and Confluent, the client authenticates to the authorization server and posts grant_type=client_credentials to its token endpoint; scope is optional. This explains the client-ID/client-secret model but does not independently establish every token exchange flow ASP supports. (high confidence) [source]
Facts and statements
- MongoDB currently restricts ASP Kafka OIDC authentication to identity providers reachable over public networks and explicitly states that identity providers within a customer VPC are unsupported. (low confidence) (verified as of 2026-10-31) [source]
- ASP optionally accepts an OAuth scope and SASL extensions for OAUTHBEARER. The API names these authentication.scope and authentication.saslOauthbearerExtensions; scope describes requested broker access and extensions carry additional information to the broker. (high confidence) (verified as of 2026-10-31) [source]
- Private Kafka connectivity and IdP reachability must be assessed separately. The ASP Kafka Private Link guide includes OAUTHBEARER/OIDC under SASL_SSL, while the operations guide retains the public-IdP restriction. Inference: configuring Kafka Private Link does not establish support for an IdP inside the customer VPC. (high confidence) (verified as of 2026-10-31) [source]
- ASP describes tokenEndpointUrl as the issuer endpoint used to retrieve a token, separate from Kafka bootstrap servers. Confluent independently describes obtaining a JWT from the IdP and presenting it through SASL/OAUTHBEARER to Kafka. This explains the separate token-service dependency without establishing ASP implementation details; successful broker routing alone does not verify token-endpoint access. (high confidence) (verified as of 2026-10-31) [source]
- MongoDB Atlas Terraform provider version 2.1.0, dated October 22, 2025, added OIDC Kafka authentication to mongodbatlas_stream_connection and its singular and plural data sources. This release evidence belongs to MongoDB and is not an independent organisational corroboration. (low confidence) (verified as of 2025-10-22) [source]
Children
- No children recorded.