KIP-255 — OAuth Authentication via SASL/OAUTHBEARER

Accepted Kafka 2.0 Security

Adds SASL/OAUTHBEARER as a first-class SASL mechanism, enabling Kafka clients and brokers to authenticate using OAuth 2 access tokens via a pluggable LoginCallbackHandler and token validation interface. This is needed because OAuth 2 is widely adopted in enterprises and Kafka had no native support for JWT/bearer-token-based authentication.

Details