Skip to content

cmake: kafka: fix OAuth Bearer detection on Windows #11294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bp-cheng wants to merge 5 commits into
base: master
Choose a base branch
from
Open

cmake: kafka: fix OAuth Bearer detection on Windows #11294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
55a25b2
cmake: kafka: fix OAuth Bearer detection on Windows
bp-cheng Dec 16, 2025
e32b091
cmake: kafka: fix OAuth Bearer detection on Windows
bp-cheng Dec 22, 2025
846f8f4
cmake: kafka: Use FLB_SYSTEM_WINDOWS to detect Windows
bp-cheng Dec 22, 2025
f5f72ac
cmake: kafka: enable SASL/SSPI support on Windows for OAuth
bp-cheng Dec 29, 2025
6c5f5b5
cmake: kafka: fix MSK IAM authentication on Windows
bp-cheng Dec 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -812,13 +812,15 @@ endif()

# AWS MSK IAM detection (must come after Kafka section)
if(FLB_AWS AND FLB_KAFKA)
# Check if Kafka SASL support was detected
if(DEFINED FLB_SASL_ENABLED AND FLB_SASL_ENABLED)
# Check if Kafka OAuth Bearer support was detected
# On Windows: uses SSPI (no Cyrus SASL needed, just SSL)
# On Linux/macOS: uses Cyrus SASL (libsasl2)
if(DEFINED FLB_KAFKA_MSK_IAM_ENABLED AND FLB_KAFKA_MSK_IAM_ENABLED)
set(FLB_HAVE_AWS_MSK_IAM ON) # Set CMake variable
FLB_DEFINITION(FLB_HAVE_AWS_MSK_IAM) # Set preprocessor definition
message(STATUS "AWS MSK IAM authentication: ENABLED")
else()
message(STATUS "AWS MSK IAM authentication: DISABLED (requires Kafka with libsasl2)")
message(STATUS "AWS MSK IAM authentication: DISABLED (requires Kafka with OAuth Bearer support)")
endif()
else()
if(FLB_AWS AND NOT FLB_KAFKA)
Expand Down
23 changes: 20 additions & 3 deletions cmake/kafka.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,14 +28,31 @@ else()
endif()
endif()

# OAuth Bearer is built into librdkafka when SASL is available
set(FLB_SASL_OAUTHBEARER_ENABLED ${FLB_SASL_ENABLED})
# OAuth Bearer support:
# - Windows: Built-in SASL, only needs SSL (no Cyrus SASL required)
# - Linux/macOS: Needs both SSL and Cyrus SASL
if(FLB_SYSTEM_WINDOWS)
if(FLB_TLS)
set(FLB_SASL_OAUTHBEARER_ENABLED ON)
else()
set(FLB_SASL_OAUTHBEARER_ENABLED OFF)
endif()
else()
# Non-Windows platforms: require Cyrus SASL
set(FLB_SASL_OAUTHBEARER_ENABLED ${FLB_SASL_ENABLED})
endif()

# MSK IAM requires OAuth Bearer support
set(FLB_KAFKA_MSK_IAM_ENABLED ${FLB_SASL_OAUTHBEARER_ENABLED})

# Configure librdkafka options
FLB_OPTION(WITH_SASL ${FLB_SASL_ENABLED})
# On Windows, enable WITH_SASL for SSPI support (built-in, no Cyrus needed)
# On other platforms, WITH_SASL depends on Cyrus SASL availability
if(FLB_SYSTEM_WINDOWS)
FLB_OPTION(WITH_SASL ON)
else()
FLB_OPTION(WITH_SASL ${FLB_SASL_ENABLED})
endif()
FLB_OPTION(WITH_SSL On)
FLB_OPTION(WITH_SASL_OAUTHBEARER ${FLB_SASL_OAUTHBEARER_ENABLED})
FLB_OPTION(WITH_SASL_CYRUS ${FLB_SASL_ENABLED})
Expand Down