KIP-1258 — Add Support for OAuth Client Assertion to client_credentials Grant Type

Accepted Security

Adds support for OAuth 2.0 client assertion (JWT Bearer, per RFC 7521/7523) as an authentication method for the client_credentials grant in Kafka's OAUTHBEARER SASL implementation. The current implementation only supports client_secret via HTTP Basic authentication (KIP-768), which requires sharing a long-lived secret—a security liability in zero-trust, short-lived-credential environments.

Details