From 80475f011bf8f7ffbd5afa50fb5df37cdac0825d Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 7 May 2026 15:25:39 +0200
Subject: [PATCH] feat(kafka-trigger): OAUTHBEARER + SASL_SSL support (#9054)

* [ee] feat(kafka-trigger): enable librdkafka OIDC for OAUTHBEARER

Adds the curl-static feature to the rdkafka dependency so librdkafka is
built with libcurl + OpenSSL, which it requires to perform the
client_credentials token exchange used by sasl.oauthbearer.method=oidc.
Without this feature librdkafka rejects sasl.oauthbearer.token.endpoint.url
at runtime with "OAuth/OIDC depends on libcurl and OpenSSL which were not
available at build time".

Pairs with windmill-ee-private#<TBD> which adds the SASL_SSL_OAUTHBEARER
KafkaResourceSecurity variant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to c6d55247a7fd951f561e0b2ad2ac13051274aa77

This commit updates the EE repository reference after PR #559 was merged in windmill-ee-private.

Previous ee-repo-ref: ce88502234f3f5886d2094dc25b30a702de9b8b1

New ee-repo-ref: c6d55247a7fd951f561e0b2ad2ac13051274aa77

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 backend/Cargo.lock      | 16 ++++++++++++++++
 backend/Cargo.toml      |  2 +-
 backend/ee-repo-ref.txt |  2 +-
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 2be24350b2..934e354b81 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2836,6 +2836,21 @@ dependencies = [
  "cmov",
 ]
 
+[[package]]
+name = "curl-sys"
+version = "0.4.88+curl-8.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "644816de6547255eff4e491a1dda1c19b7237f00b62a61e6e64859ce4f2906d0"
+dependencies = [
+ "cc",
+ "libc",
+ "libz-sys",
+ "openssl-sys",
+ "pkg-config",
+ "vcpkg",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "4.1.3"
@@ -11107,6 +11122,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e234cf318915c1059d4921ef7f75616b5219b10b46e9f3a511a15eb4b56a3f77"
 dependencies = [
  "cmake",
+ "curl-sys",
  "libc",
  "libz-sys",
  "num_enum",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 324b586510..bca281ba48 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -546,7 +546,7 @@ tokio-native-tls = "^0"
 openssl = "=0.10"
 mail-parser = "^0"
 matchit = "=0.7.3"
-rdkafka = { version = "0.36.2", features = ["cmake-build", "ssl-vendored"] }
+rdkafka = { version = "0.36.2", features = ["cmake-build", "ssl-vendored", "curl-static"] }
 rdkafka-sys = "=4.9.0"
 pg_escape = "0.1.1"
 async-nats = "0.38.0"
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 9ccafe345b..a7f74deae6 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-5a07053c8c4d50b6cd2100d96fed8f73b78f1fd0
+c6d55247a7fd951f561e0b2ad2ac13051274aa77