rpk: add OAUTHBEARER SASL mechanism support

[david-yu]

Summary

• Add OAUTHBEARER as a supported SASL mechanism for rpk, enabling OIDC-based authentication with Kafka brokers
• The token is passed via --password (supports both raw token and token:<TOKEN> format)
• OAUTHBEARER support added to Kafka client, admin API, and schema registry clients
• Unit tests for token extraction, admin API auth, and Kafka client error paths
• Updated -X help / -X list and profile docs to document all four SASL mechanisms

Ref: https://docs.redpanda.com/current/manage/security/authentication/#oidc
Ref: https://github.com/david-yu/redpanda-operator-mtls-oidc-listeners

Usage Examples

Obtain an OIDC token

# Example: get a token from Dex via password grant
export OIDC_TOKEN=$(curl -s -X POST "https://dex.example.com/dex/token" \
  -d "grant_type=password&username=user@example.com&password=password" \
  -d "client_id=redpanda&client_secret=redpanda-secret&scope=openid email" \
  | jq -r '.access_token')

Topic operations

# List topics
rpk topic list \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Create a topic
rpk topic create oidc-test \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Produce messages
echo "hello from OIDC client" | rpk topic produce oidc-test \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Consume messages
rpk topic consume oidc-test --num 1 \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Describe a topic
rpk topic describe oidc-test \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Delete a topic
rpk topic delete oidc-test \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

Consumer group operations

# List consumer groups
rpk group list \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Describe a consumer group
rpk group describe my-group \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

Cluster operations

# Cluster info
rpk cluster info \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Cluster health
rpk cluster health \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

ACL operations

# List ACLs
rpk security acl list \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

# Create an ACL
rpk security acl create --allow-principal User:user@example.com \
  --operation all --topic oidc-test \
  --brokers localhost:31094 \
  --tls-enabled \
  --tls-truststore certs/ca.crt \
  --sasl-mechanism OAUTHBEARER \
  --password "token:${OIDC_TOKEN}"

Using a profile (avoids repeating flags)

rpk profile create oidc-profile \
  --set kafka_api.brokers=localhost:31094 \
  --set kafka_api.tls.ca_file=certs/ca.crt \
  --set kafka_api.sasl.mechanism=OAUTHBEARER \
  --set kafka_api.sasl.password="token:${OIDC_TOKEN}"

# Now commands use the profile automatically
rpk topic list
rpk topic create oidc-test
rpk cluster info

Test plan

Unit tests (all passing)

• oauthBearerToken helper — token prefix stripping, raw tokens, empty inputs, case sensitivity
• GetAuth with OAUTHBEARER — bearer token construction, case-insensitivity, empty token error, token:-only error
• GetAuth regression — SCRAM-SHA-256 still returns BasicAuth, no-SASL still returns NopAuth
• NewFranzClient error paths — OAUTHBEARER with empty token, token:-only prefix, unknown mechanism

E2E tested locally on Kind + Dex OIDC provider

Tested with a local rpk build against a Kind cluster running Redpanda with Dex as the OIDC provider
(setup).
Redpanda configured with oidc_discovery_url, oidc_token_audience, oidc_principal_mapping,
and an OIDC listener with sasl_mechanisms_overrides: [OAUTHBEARER] on NodePort 31094.

#	Test	Result
1	rpk topic list	Listed topics (_schemas, mtls-test)
2	rpk topic create oidc-rpk-test	Created OK
3	rpk topic produce oidc-rpk-test	Produced to partition 0, offset 0
4	rpk topic consume oidc-rpk-test --num 1	Consumed message
5	rpk topic describe oidc-rpk-test	Full topic config returned
6	rpk group list	Listed groups
7	rpk cluster info	Cluster ID, broker, topics returned
8	rpk topic delete oidc-rpk-test	Deleted OK
9	Raw token (no token: prefix)	Worked
10	No token provided	Error: "OAUTHBEARER requires a token"
11	Empty token: prefix	Error: "OAUTHBEARER requires a token"

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}