strimzi/strimzi-kafka-oauth

Strimzi OAuth for Apache Kafka is an OAuth2 authentication and authorization library that extends Apache Kafka with production-ready integration for OAuth2 and OIDC authorization servers.

Apache Kafka includes basic OAuth2 support through SASL, but historically lacked built-in integration with authorization servers for obtaining and validating access tokens in production environments. Strimzi OAuth solves this by providing JAAS callback handlers and extensions that enable real-world OAuth2 workflows. The tool supports both opaque and JWT access tokens, works with multiple client and server workflows, and offers more configuration options than Kafka's native OAuth2 support. It integrates deeply with Keycloak and includes token-based authorization mechanisms that connect to Keycloak Authorization Services.

Teams running Kafka on Kubernetes or using Strimzi for cluster management should consider this tool, particularly if they rely on Keycloak or other OIDC-compliant authorization servers. It suits projects requiring fine-grained access control and flexible token handling beyond what Kafka's built-in OAuth2 module provides. While recent Kafka versions have improved their native OAuth2 support to production quality, this tool remains valuable for deployments needing broader workflow support, additional configuration flexibility, or Keycloak-specific features like authorization services integration.

The project maintains active engagement with its community through regular updates and issue resolution. Development activity shows consistent attention to both bug fixes and feature enhancements across the codebase. The maintainers demonstrate responsiveness to user feedback and maintain thorough documentation to support adoption and troubleshooting.