Confluent Cloud customers who run their own OAuth/OIDC identity provider need to authenticate this driver with a bearer token they mint themselves — an external token, in Confluent's authorization vocabulary — rather than a Confluent API key + secret. This epic covers that BYOIDC (bring-your-own-IdP) surface end to end, as small independently-shippable children.
Scope boundary: Flink data plane only
By Confluent's authorization model (verified against the Cloud OpenAPI spec's per-operation AUTHORIZATIONS blocks), a raw external token authenticates the Flink data plane and nothing on api.confluent.cloud. None of /tableflow/v1, /connect/v1, /cmk/v2/clusters, or /org/v2/organizations accept external-access-token. So every child here is Flink-only, and the control plane fails closed with an error. Reaching the control plane with a caller identity is a different problem, covered in a separate epic, which mints Confluent's own tokens.
The bar: cover plugin #399's BYOIDC half
The neighboring Java Table API client shipped two BYOIDC-flavoured modes in one large PR: a static external-access-token and a refreshing client-credentials provider. This epic covers the same ground as a sequence of bounded children rather than one mega-PR
Confluent Cloud customers who run their own OAuth/OIDC identity provider need to authenticate this driver with a bearer token they mint themselves — an external token, in Confluent's authorization vocabulary — rather than a Confluent API key + secret. This epic covers that BYOIDC (bring-your-own-IdP) surface end to end, as small independently-shippable children.
Scope boundary: Flink data plane only
By Confluent's authorization model (verified against the Cloud OpenAPI spec's per-operation
AUTHORIZATIONSblocks), a raw external token authenticates the Flink data plane and nothing onapi.confluent.cloud. None of/tableflow/v1,/connect/v1,/cmk/v2/clusters, or/org/v2/organizationsacceptexternal-access-token. So every child here is Flink-only, and the control plane fails closed with an error. Reaching the control plane with a caller identity is a different problem, covered in a separate epic, which mints Confluent's own tokens.The bar: cover plugin #399's BYOIDC half
The neighboring Java Table API client shipped two BYOIDC-flavoured modes in one large PR: a static
external-access-tokenand a refreshing client-credentials provider. This epic covers the same ground as a sequence of bounded children rather than one mega-PR