private_key_jwt JWKS support for Generic OIDC connect

[buznyusz]

Strong authentication is expected in the enterprise environment, so also with OIDC, JWKS AUTH should be an auth option for OIDC server connection, in addition to the current clientID +secret

Why is solving this problem impactful?

Higher security standard

Additional notes

https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_jwks_endpoint.html

JIRA Link: CORE-8729

[dotnwat]

hi @buznyusz is this something supported by Apache Kafka?

[buznyusz]

hi @buznyusz is this something supported by Apache Kafka?

Hello
the Apache Kafka supports only the client_credential type ( clientID+Secret ) OIDC connection.
The OIDC auth is an Enterprise feature so i think we have to check other Enterprise grade competitors feature set like Confluent where the private_key JWKS AUTH is available https://docs.confluent.io/platform/current/installation/configuration/broker-configs.html#sasl-oauthbearer-clientassertion-private-key

[dotnwat]

Thanks @buznyusz ill pass this along internally

[dotnwat]

@deniscoady