KIP-768 — Extend SASL/OAUTHBEARER with Support for OIDC

Accepted Kafka 3.1 Security

Adds built-in support for OAuth 2.0 / OIDC token-based authentication in the Kafka client and broker SASL layer, including token refresh and JWKS-based validation. Organizations adopting centralized identity providers (Okta, Azure AD, etc.) previously had no standard way to integrate OAuth-based auth with Kafka without custom SASL callback handlers.

Details