README.md
Authentication configuration
This module defines necessary interfaces to implement server and client type authenticators:
- Server type authenticators perform authentication for incoming HTTP/gRPC requests and are typically used in receivers.
- Client type authenticators perform client-side authentication for outgoing HTTP/gRPC requests and are typically used in exporters.
The currently known authenticators are listed below.
Server Authenticators
Client Authenticators
- ASAP Client Authentication Extension
- Basic Auth Extension
- Bearer Token Extension
- OAuth2 Client Extension
- Sigv4 Extension
Example:
yaml
| 1 | extensions: |
| 2 | oidc: |
| 3 | # see the blog post on securing the otelcol for information |
| 4 | # on how to setup an OIDC server and how to generate the TLS certs |
| 5 | # required for this example |
| 6 | # https://medium.com/opentelemetry/securing-your-opentelemetry-collector-1a4f9fa5bd6f |
| 7 | issuer_url: http://localhost:8080/auth/realms/opentelemetry |
| 8 | audience: account |
| 9 | |
| 10 | oauth2client: |
| 11 | client_id: someclientid |
| 12 | client_secret: someclientsecret |
| 13 | token_url: https://example.com/oauth2/default/v1/token |
| 14 | scopes: ["api.metrics"] |
| 15 | # tls settings for the token client |
| 16 | tls: |
| 17 | insecure: true |
| 18 | ca_file: /var/lib/mycert.pem |
| 19 | cert_file: certfile |
| 20 | key_file: keyfile |
| 21 | # timeout for the token client |
| 22 | timeout: 2s |
| 23 | |
| 24 | receivers: |
| 25 | otlp/with_auth: |
| 26 | protocols: |
| 27 | grpc: |
| 28 | endpoint: localhost:4318 |
| 29 | tls: |
| 30 | cert_file: /tmp/certs/cert.pem |
| 31 | key_file: /tmp/certs/cert-key.pem |
| 32 | auth: |
| 33 | ## oidc is the extension name to use as the authenticator for this receiver |
| 34 | authenticator: oidc |
| 35 | |
| 36 | exporters: |
| 37 | otlp_http/withauth: |
| 38 | endpoint: http://localhost:9000 |
| 39 | auth: |
| 40 | authenticator: oauth2client |
Creating an authenticator
New authenticators can be added by creating a new extension that also implements the appropriate interface (configauth.ServerAuthenticator or configauth.ClientAuthenticator).
Generic authenticators that may be used by a good number of users might be accepted as part of the contrib distribution. If you have an interest in contributing an authenticator, open an issue with your proposal. For other cases, you'll need to include your custom authenticator as part of your custom OpenTelemetry Collector, perhaps being built using the OpenTelemetry Collector Builder.