sasl.oauthbearer.allow.unverified.audience — Kafka Broker Configuration

The (optional) setting that allows the broker to validate JWTs without verifying the audience. By default the broker requires sasl.oauthbearer.expected.audience to be set whenever sasl.oauthbearer.jwks.endpoint.url is configured, and rejects any JWT whose "aud" claim does not match one of the expected audiences

Description

The (optional) setting that allows the broker to validate JWTs without verifying the audience. By default the broker requires sasl.oauthbearer.expected.audience to be set whenever sasl.oauthbearer.jwks.endpoint.url is configured, and rejects any JWT whose "aud" claim does not match one of the expected audiences. When this is set to true that requirement is lifted: the "aud" claim is no longer checked and a JWT bearing any (or no) audience is accepted. Leaving the audience unverified is insecure and strongly discouraged; enable it only for deployments that intentionally accept tokens regardless of their intended audience. The default value is 'false'.

Default Values by Kafka Version