sasl.oauthbearer.allow.unverified.issuer — Kafka Broker Configuration

The (optional) setting that allows the broker to validate JWTs without verifying the issuer. By default the broker requires sasl.oauthbearer.expected.issuer to be set whenever sasl.oauthbearer.jwks.endpoint.url is configured, and rejects any JWT whose "iss" claim does not match the expected issuer

Description

The (optional) setting that allows the broker to validate JWTs without verifying the issuer. By default the broker requires sasl.oauthbearer.expected.issuer to be set whenever sasl.oauthbearer.jwks.endpoint.url is configured, and rejects any JWT whose "iss" claim does not match the expected issuer. When this is set to true that requirement is lifted: the "iss" claim is no longer checked and a JWT bearing any (or no) issuer is accepted. Leaving the issuer unverified is insecure and strongly discouraged; enable it only for deployments that intentionally accept tokens regardless of which issuer minted them. The default value is 'false'.

Default Values by Kafka Version