feat: Support OIDC configs in mongodbatlas_stream_connection #3680

LijieZhang1998 · 2025-09-10T00:07:59Z

Description

This ticket added one authentication mechanism to the Kafka connection.

Link to any related issue(s): https://jira.mongodb.org/browse/CLOUDP-338207

Type of change:

Bug fix (non-breaking change which fixes an issue). Please, add the "bug" label to the PR.
New feature (non-breaking change which adds functionality). Please, add the "enhancement" label to the PR. A migration guide must be created or updated if the new feature will go in a major version.
Breaking change (fix or feature that would cause existing functionality to not work as expected). Please, add the "breaking change" label to the PR. A migration guide must be created or updated.
This change requires a documentation update
Documentation fix/enhancement

Required Checklist:

I have signed the MongoDB CLA
I have read the contributing guides
I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
I have added tests that prove my fix is effective or that my feature works per HashiCorp requirements
I have added any necessary documentation (if appropriate)
I have run make fmt and formatted my code
If changes include deprecations or removals I have added appropriate changelog entries.
If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Further comments

…_connection

github-actions · 2025-09-10T17:35:53Z

APIx bot: a message has been sent to Docs Slack channel

jwilliams-mongo · 2025-09-10T20:16:12Z

docs/data-sources/stream_connection.md

 * `username` - Username of the account to connect to the Kafka cluster.
 * `password` - Password of the account to connect to the Kafka cluster.
+* `token_endpoint_url` -  OAUTH issuer token endpoint HTTP(S) URI used to retrieve the token.
+* `client_id` - Public identifier for the kafka client. It must be unique across all clients that the authorization server handles.


Suggested change

* `client_id` - Public identifier for the kafka client. It must be unique across all clients that the authorization server handles.

* `client_id` - Public identifier for the Kafka client. It must be unique across all clients that the authorization server handles.

what is the consequence of this not being unique? Guessing a token wouldn't be issued, but it's not clear why this must be unique.

The uniqueness is applied to the authorization server(IdP provider). If I remove the second sentence, does it make sense to you?

docs/data-sources/stream_connection.md

jwilliams-mongo · 2025-09-10T20:17:04Z

docs/data-sources/stream_connection.md

+* `client_secret` - Secret known only to the kafka client and the authorization server.
+* `scope` - Kafka clients use this to specify the scope of the access request to the broker.
+* `sasl_oauthbearer_extensions` - Additional information to be provided to the kafka broker.
+* `https_ca_pem` - The CA certificates as a PEM string.


do you think it would be helpful to note these should be concatenated? Any specific certs in the chain that are not required? is a specific order required?

What do you mean by "be concatenated"? No specific order is required. We don't want to mark optional on the fields because the OpenID protocol is very flexible. We can't guarantee whether field is a must or not. For backward compatibility, we don't indicate whether it is mandatory or not.

docs/data-sources/stream_connections.md

docs/resources/stream_connection.md

examples/mongodbatlas_stream_connection/main.tf

examples/mongodbatlas_stream_connection/variables.tf

jwilliams-mongo · 2025-09-10T20:24:46Z

docs/data-sources/stream_connection.md

 * `username` - Username of the account to connect to the Kafka cluster.
 * `password` - Password of the account to connect to the Kafka cluster.
+* `token_endpoint_url` -  OAUTH issuer token endpoint HTTP(S) URI used to retrieve the token.


do you think it would help to clarify that this is usually an IdP

Is this ok?

Suggested change

* `token_endpoint_url` - OAUTH issuer token endpoint HTTP(S) URI used to retrieve the token.

* `token_endpoint_url` - OAUTH issuer(IdP provider) token endpoint HTTP(S) URI used to retrieve the token.

lantoli · 2025-09-12T15:03:11Z

as discussed offline please don't merge until 2.0.0 is released

lantoli · 2025-09-12T15:04:25Z

.changelog/3680.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/mongodbatlas_stream_connection: Add new authentication mechanism(OIDC) to the Kafka connection


Suggested change

resource/mongodbatlas_stream_connection: Add new authentication mechanism(OIDC) to the Kafka connection

resource/mongodbatlas_stream_connection: Adds new authentication mechanism(OIDC) to the Kafka connection

3rd person for changelog messages

lantoli · 2025-09-12T15:05:26Z

.changelog/3680.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement


changelog entries for the 2 datasources are missing

lantoli · 2025-09-12T15:07:15Z

docs/data-sources/stream_connection.md

 * `username` - Username of the account to connect to the Kafka cluster.
 * `password` - Password of the account to connect to the Kafka cluster.
+* `token_endpoint_url` -  OAUTH issuer(IdP provider) token endpoint HTTP(S) URI used to retrieve the token.
+* `client_id` - Public identifier for the Kafka client.


do all new attributes apply to Kafka? in that case consider having them inside a kafka_config nested attribute, although it's probably better to follow as it's in the Atlas API

lantoli · 2025-09-12T15:08:31Z

docs/resources/stream_connection.md

@@ -55,6 +55,38 @@ resource "mongodbatlas_stream_connection" "test" {
 }    
 ```

+### Example Kafka SASL OAuthbearer Connection


new attributes description is missing in resource doc page

lantoli · 2025-09-12T15:10:56Z

internal/service/streamconnection/resource_schema.go

+						Optional:  true,
+						Sensitive: true,
+					},
+					"scope": schema.StringAttribute{


q: does Atlas return some default value if not provided by the client? in that case the atribute might need to be Optional & Computed, although better to keep it as Optional if possible

lantoli · 2025-09-12T15:11:42Z

internal/service/streamconnection/resource_stream_connection_test.go

+	resource.ParallelTest(t, *testCase)
+}
+
+func testCaseKafkaOAuthBearer(t *testing.T, nameSuffix string) *resource.TestCase {


why not inline testCaseKafkaOAuthBearer in TestAccStreamRSStreamConnection_kafkaOAuthBearer ?

CLOUDP-338207: Terraform: support OIDC configs in mongodbatlas_stream…

8d9c0aa

…_connection

LijieZhang1998 added the enhancement label Sep 10, 2025

LijieZhang1998 changed the title ~~feat: support OIDC configs in mongodbatlas_stream_connection~~ feat: Support OIDC configs in mongodbatlas_stream_connection Sep 10, 2025

LijieZhang1998 added 4 commits September 10, 2025 10:00

Fix lint and changelog issues

f0e6f3c

Fix changelog issues

7b67ebc

Fix lint issues

b37d57e

Fix fmt issues

5d586ec

LijieZhang1998 marked this pull request as ready for review September 10, 2025 17:35

LijieZhang1998 requested review from a team as code owners September 10, 2025 17:35

jwilliams-mongo reviewed Sep 10, 2025

View reviewed changes

Refactor by comments

6f75bbe

lantoli reviewed Sep 12, 2025

View reviewed changes

.changelog/3680.txt

@@ -0,0 +1,3 @@

```release-note:enhancement

Copy link

Member

lantoli Sep 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changelog entries for the 2 datasources are missing

lantoli reviewed Sep 12, 2025

View reviewed changes

	* `client_id` - Public identifier for the kafka client. It must be unique across all clients that the authorization server handles.
	* `client_id` - Public identifier for the Kafka client. It must be unique across all clients that the authorization server handles.

	* `token_endpoint_url` - OAUTH issuer token endpoint HTTP(S) URI used to retrieve the token.
	* `token_endpoint_url` - OAUTH issuer(IdP provider) token endpoint HTTP(S) URI used to retrieve the token.

		@@ -0,0 +1,3 @@
		```release-note:enhancement
		resource/mongodbatlas_stream_connection: Add new authentication mechanism(OIDC) to the Kafka connection

feat: Support OIDC configs in mongodbatlas_stream_connection #3680

Are you sure you want to change the base?

feat: Support OIDC configs in mongodbatlas_stream_connection #3680

Conversation

LijieZhang1998 commented Sep 10, 2025

Description

Type of change:

Required Checklist:

Further comments

Uh oh!

github-actions bot commented Sep 10, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jwilliams-mongo Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lantoli commented Sep 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lantoli Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lantoli Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jwilliams-mongo Sep 10, 2025 •

edited

Loading

lantoli Sep 12, 2025 •

edited

Loading

lantoli Sep 12, 2025 •

edited

Loading