@platformatic/rdkafka 4.0.1 → 4.1.0-alpha.1

package/deps/librdkafka/tests/0115-producer_auth.cpp

@@ -86,7 +86,7 @@ static void do_test_producer(bool topic_known) {
 
   /* Create topic */
   std::string topic_unauth = Test::mk_topic_name("0115-unauthorized", 1);
-  Test::create_topic(NULL, topic_unauth.c_str(), 3, 1);
+  Test::create_topic_wait_exists(NULL, topic_unauth.c_str(), 3, 1, 5000);
 
   int exp_dr_cnt = 0;
 
@@ -112,6 +112,9 @@ static void do_test_producer(bool topic_known) {
       "--topic '%s'",
       bootstraps.c_str(), topic_unauth.c_str());
 
+  /* Allow ACLs to propagate */
+  rd_sleep(1);
+
   /* Produce message to any partition. */
   Test::Say("Producing message 1 to any partition\n");
   err = p->produce(topic_unauth, RdKafka::Topic::PARTITION_UA,

package/deps/librdkafka/tests/0116-kafkaconsumer_close.cpp

@@ -2,6 +2,7 @@
  * librdkafka - Apache Kafka C library
  *
  * Copyright (c) 2020-2022, Magnus Edenhill
+ *               2025, Confluent Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -81,11 +82,10 @@ static void do_test_consumer_close(bool do_subscribe,
                                    bool do_unsubscribe,
                                    bool do_close,
                                    bool with_queue) {
-  std::string testname = tostr()
-                         << "Test C++ KafkaConsumer close "
-                         << "subscribe=" << do_subscribe
-                         << ", unsubscribe=" << do_unsubscribe
-                         << ", close=" << do_close << ", queue=" << with_queue;
+  std::string testname =
+      tostr() << "Test C++ KafkaConsumer close " << "subscribe=" << do_subscribe
+              << ", unsubscribe=" << do_unsubscribe << ", close=" << do_close
+              << ", queue=" << with_queue;
   SUB_TEST("%s", testname.c_str());
 
   rd_kafka_mock_cluster_t *mcluster;
@@ -199,6 +199,8 @@ static void do_test_consumer_close(bool do_subscribe,
 
 extern "C" {
 int main_0116_kafkaconsumer_close(int argc, char **argv) {
+  TEST_SKIP_MOCK_CLUSTER(0);
+
   /* Parameters:
    *  subscribe, unsubscribe, close, with_queue */
   for (int i = 0; i < 1 << 4; i++) {

package/deps/librdkafka/tests/0117-mock_errors.c

@@ -2,6 +2,7 @@
  * librdkafka - Apache Kafka C library
  *
  * Copyright (c) 2020-2022, Magnus Edenhill
+ *               2025, Confluent Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -102,8 +103,10 @@ static void do_test_offset_commit_error_during_rebalance(void) {
         rd_kafka_t *c1, *c2;
         rd_kafka_mock_cluster_t *mcluster;
         const char *bootstraps;
-        const char *topic = "test";
-        const int msgcnt  = 100;
+        const char *topic            = "test";
+        const int msgcnt             = 100;
+        const int exp_msg_cnt_intial = 1;
+        int exp_msg_cnt_final        = msgcnt;
         rd_kafka_resp_err_t err;
 
         SUB_TEST();
@@ -136,8 +139,8 @@ static void do_test_offset_commit_error_during_rebalance(void) {
 
 
         /* Wait for assignment and one message */
-        test_consumer_poll("C1.PRE", c1, 0, -1, -1, 1, NULL);
-        test_consumer_poll("C2.PRE", c2, 0, -1, -1, 1, NULL);
+        test_consumer_poll("C1.PRE", c1, 0, -1, -1, exp_msg_cnt_intial, NULL);
+        test_consumer_poll("C2.PRE", c2, 0, -1, -1, exp_msg_cnt_intial, NULL);
 
         /* Trigger rebalance */
         test_consumer_close(c2);
@@ -161,8 +164,15 @@ static void do_test_offset_commit_error_during_rebalance(void) {
                     "not %s",
                     rd_kafka_err2name(err));
 
+        /* Since all the assignors in the `consumer` protocol are COOPERATIVE
+         * only the new partitions are assigned to the consumer. All the
+         * previously assigned partitions will start consuming from the last
+         * offset. */
+        if (!test_consumer_group_protocol_classic())
+                exp_msg_cnt_final = msgcnt - exp_msg_cnt_intial;
+
         /* Wait for new assignment and able to read all messages */
-        test_consumer_poll("C1.PRE", c1, 0, -1, -1, msgcnt, NULL);
+        test_consumer_poll("C1.POST", c1, 0, -1, -1, exp_msg_cnt_final, NULL);
 
         rd_kafka_destroy(c1);
 

package/deps/librdkafka/tests/0118-commit_rebalance.c

@@ -2,6 +2,7 @@
  * librdkafka - Apache Kafka C library
  *
  * Copyright (c) 2020-2022, Magnus Edenhill
+ *               2025, Confluent Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -34,6 +35,7 @@
 
 static rd_kafka_t *c1, *c2;
 
+static int rebalances = 0;
 
 static void rebalance_cb(rd_kafka_t *rk,
                          rd_kafka_resp_err_t err,
@@ -42,16 +44,18 @@ static void rebalance_cb(rd_kafka_t *rk,
 
         TEST_SAY("Rebalance for %s: %s: %d partition(s)\n", rd_kafka_name(rk),
                  rd_kafka_err2name(err), parts->cnt);
-
+        rebalances++;
         if (err == RD_KAFKA_RESP_ERR__ASSIGN_PARTITIONS) {
-                TEST_CALL_ERR__(rd_kafka_assign(rk, parts));
+                test_consumer_assign_by_rebalance_protocol("rebalance", rk,
+                                                           parts);
 
         } else if (err == RD_KAFKA_RESP_ERR__REVOKE_PARTITIONS) {
                 rd_kafka_resp_err_t commit_err;
 
                 TEST_CALL_ERR__(rd_kafka_position(rk, parts));
 
-                TEST_CALL_ERR__(rd_kafka_assign(rk, NULL));
+                test_consumer_unassign_by_rebalance_protocol("rebalance", rk,
+                                                             parts);
 
                 if (rk == c1)
                         return;
@@ -86,7 +90,11 @@ static void rebalance_cb(rd_kafka_t *rk,
 int main_0118_commit_rebalance(int argc, char **argv) {
         const char *topic = test_mk_topic_name(__FUNCTION__, 1);
         rd_kafka_conf_t *conf;
-        const int msgcnt = 1000;
+        const int msgcnt          = 1000;
+        const int exp_msg_cnt_pre = 10;
+        int exp_msg_cnt_post      = msgcnt;
+        int exp_msg_cnt_c1_pre    = exp_msg_cnt_pre;
+        int exp_msg_cnt_c2_pre    = exp_msg_cnt_pre;
 
         test_conf_init(&conf, NULL, 60);
         test_conf_set(conf, "enable.auto.commit", "false");
@@ -103,17 +111,42 @@ int main_0118_commit_rebalance(int argc, char **argv) {
         test_consumer_subscribe(c1, topic);
         test_consumer_subscribe(c2, topic);
 
-
-        test_consumer_poll("C1.PRE", c1, 0, -1, -1, 10, NULL);
-        test_consumer_poll("C2.PRE", c2, 0, -1, -1, 10, NULL);
+        while (exp_msg_cnt_c1_pre > 0 || exp_msg_cnt_c2_pre > 0) {
+                if (exp_msg_cnt_c1_pre > 0 ||
+                    exp_msg_cnt_c2_pre == exp_msg_cnt_pre) {
+                        exp_msg_cnt_c1_pre -=
+                            test_consumer_poll_once(c1, NULL, 100);
+                        if (exp_msg_cnt_c2_pre == exp_msg_cnt_pre)
+                                /* Slow down consumption until both have
+                                 * partitions assigned. */
+                                rd_usleep(100 * 1000, 0);
+                }
+                if (exp_msg_cnt_c2_pre > 0 ||
+                    exp_msg_cnt_c1_pre == exp_msg_cnt_pre) {
+                        exp_msg_cnt_c2_pre -=
+                            test_consumer_poll_once(c2, NULL, 100);
+                        if (exp_msg_cnt_c1_pre == exp_msg_cnt_pre)
+                                /* Slow down consumption until both have
+                                 * partitions assigned. */
+                                rd_usleep(100 * 1000, 0);
+                }
+        }
 
         /* Trigger rebalance */
         test_consumer_close(c2);
         rd_kafka_destroy(c2);
 
+        /* Since all the assignors in the `consumer` protocol are COOPERATIVE
+         * only the new partitions are assigned to the consumer. All the
+         * previously assigned partitions will start consuming from the last
+         * offset. */
+        if (!test_consumer_group_protocol_classic())
+                exp_msg_cnt_post =
+                    msgcnt - exp_msg_cnt_pre + exp_msg_cnt_c1_pre;
+
         /* Since no offsets were successfully committed the remaining consumer
          * should be able to receive all messages. */
-        test_consumer_poll("C1.POST", c1, 0, -1, -1, msgcnt, NULL);
+        test_consumer_poll("C1.POST", c1, 0, -1, -1, exp_msg_cnt_post, NULL);
 
         rd_kafka_destroy(c1);
 

package/deps/librdkafka/tests/0119-consumer_auth.cpp

@@ -2,6 +2,7 @@
  * librdkafka - Apache Kafka C library
  *
  * Copyright (c) 2020-2022, Magnus Edenhill
+ *               2025, Confluent Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -61,7 +62,7 @@ static void do_test_fetch_unauth() {
 
   /* Create topic */
   const int partition_cnt = 3;
-  Test::create_topic(NULL, topic.c_str(), partition_cnt, 1);
+  Test::create_topic_wait_exists(NULL, topic.c_str(), partition_cnt, 1, 5000);
 
   /* Produce messages */
   test_produce_msgs_easy(topic.c_str(), 0, RdKafka::Topic::PARTITION_UA, 1000);
@@ -85,6 +86,9 @@ static void do_test_fetch_unauth() {
       "--topic '%s'",
       bootstraps.c_str(), topic.c_str());
 
+  /* Allow ACLs to propagate */
+  rd_sleep(1);
+
   Test::subscribe(c, topic);
 
   int auth_err_cnt = 0;
@@ -128,8 +132,23 @@ static void do_test_fetch_unauth() {
               "Expected exactly %d auth errors, saw %d", partition_cnt,
               auth_err_cnt);
 
+  c->close();
   delete c;
 
+  test_kafka_cmd(
+      "kafka-acls.sh --bootstrap-server %s "
+      "--remove --force --allow-principal 'User:*' "
+      "--operation Describe --allow-host '*' "
+      "--topic '%s'",
+      bootstraps.c_str(), topic.c_str());
+
+  test_kafka_cmd(
+      "kafka-acls.sh --bootstrap-server %s "
+      "--remove --force --deny-principal 'User:*' "
+      "--operation Read --deny-host '*' "
+      "--topic '%s'",
+      bootstraps.c_str(), topic.c_str());
+
   Test::Say(tostr() << _C_GRN << "[ Test unauthorized Fetch PASS ]\n");
 }
 

package/deps/librdkafka/tests/0120-asymmetric_subscription.c

@@ -169,10 +169,15 @@ int main_0120_asymmetric_subscription(int argc, char **argv) {
         rd_kafka_mock_topic_create(mcluster, "t3", _PART_CNT, 1);
         rd_kafka_mock_topic_create(mcluster, "t4", _PART_CNT, 1);
 
-
-        do_test_asymmetric("roundrobin", bootstraps);
         do_test_asymmetric("range", bootstraps);
-        do_test_asymmetric("cooperative-sticky", bootstraps);
+
+        /* These tests would be duplicate with KIP 848 protocol,
+         * given we're not testing the assignment here,
+         * as it's mocked. */
+        if (test_consumer_group_protocol_classic()) {
+                do_test_asymmetric("roundrobin", bootstraps);
+                do_test_asymmetric("cooperative-sticky", bootstraps);
+        }
 
         test_mock_cluster_destroy(mcluster);
 

package/deps/librdkafka/tests/0125-immediate_flush.c

@@ -48,7 +48,7 @@ void do_test_flush_overrides_linger_ms_time() {
         rd_kafka_conf_set_dr_msg_cb(conf, test_dr_msg_cb);
         rk = test_create_handle(RD_KAFKA_PRODUCER, conf);
 
-        test_create_topic(rk, topic, 1, 1);
+        test_create_topic_wait_exists(rk, topic, 1, 1, 5000);
 
         /* Produce half set of messages without waiting for delivery. */
         test_produce_msgs2_nowait(rk, topic, 0, 0, 0, msgcnt / 2, NULL, 50,

package/deps/librdkafka/tests/0126-oauthbearer_oidc.c

@@ -2,6 +2,7 @@
  * librdkafka - Apache Kafka C library
  *
  * Copyright (c) 2021-2022, Magnus Edenhill
+ *               2025, Confluent Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31,6 +32,11 @@
  * is built from within the librdkafka source tree and thus differs. */
 #include "rdkafka.h" /* for Kafka driver */
 
+#define TEST_FIXTURES_FOLDER             "./fixtures"
+#define TEST_FIXTURES_OAUTHBEARER_FOLDER TEST_FIXTURES_FOLDER "/oauthbearer/"
+#define TEST_FIXTURES_JWT_ASSERTION_TEMPLATE                                   \
+        TEST_FIXTURES_OAUTHBEARER_FOLDER "jwt_assertion_template.json"
+
 static rd_bool_t error_seen;
 /**
  * @brief After config OIDC, make sure the producer and consumer
@@ -38,7 +44,8 @@ static rd_bool_t error_seen;
  *
  */
 static void
-do_test_produce_consumer_with_OIDC(const rd_kafka_conf_t *base_conf) {
+do_test_produce_consumer_with_OIDC(const char *test_name,
+                                   const rd_kafka_conf_t *base_conf) {
         const char *topic;
         uint64_t testid;
         rd_kafka_t *p1;
@@ -47,7 +54,8 @@ do_test_produce_consumer_with_OIDC(const rd_kafka_conf_t *base_conf) {
 
         const char *url = test_getenv("VALID_OIDC_URL", NULL);
 
-        SUB_TEST("Test producer and consumer with oidc configuration");
+        SUB_TEST("Test producer and consumer with oidc configuration: %s",
+                 test_name);
 
         if (!url) {
                 SUB_TEST_SKIP(
@@ -65,13 +73,13 @@ do_test_produce_consumer_with_OIDC(const rd_kafka_conf_t *base_conf) {
         p1 = test_create_handle(RD_KAFKA_PRODUCER, rd_kafka_conf_dup(conf));
 
         topic = test_mk_topic_name("0126-oauthbearer_oidc", 1);
-        test_create_topic(p1, topic, 1, 3);
+        test_create_topic_wait_exists(p1, topic, 1, 3, 5000);
         TEST_SAY("Topic: %s is created\n", topic);
 
         test_produce_msgs2(p1, topic, testid, 0, 0, 1, NULL, 0);
 
         test_conf_set(conf, "auto.offset.reset", "earliest");
-        c1 = test_create_consumer(topic, NULL, rd_kafka_conf_dup(conf), NULL);
+        c1 = test_create_consumer(topic, NULL, conf, NULL);
         test_consumer_subscribe(c1, topic);
 
         /* Give it some time to trigger the token refresh. */
@@ -142,11 +150,53 @@ static void do_test_produce_consumer_with_OIDC_expired_token_should_fail(
 
 
 /**
- * @brief After config OIDC, if the token is not valid, make sure the
+ * @brief After configiguring OIDC, make sure the
+ *        authentication fails as expected.
+ */
+static void do_test_produce_consumer_with_OIDC_should_fail(
+    const char *test_name,
+    const rd_kafka_conf_t *base_conf) {
+        rd_kafka_t *c1;
+        uint64_t testid;
+        rd_kafka_conf_t *conf;
+
+        const char *url = test_getenv("VALID_OIDC_URL", NULL);
+
+        SUB_TEST("Test authentication failure with oidc configuration: %s",
+                 test_name);
+        if (!url) {
+                SUB_TEST_SKIP(
+                    "VALID_OIDC_URL environment variable is not set\n");
+                return;
+        }
+
+        error_seen = rd_false;
+
+        conf = rd_kafka_conf_dup(base_conf);
+        test_conf_set(conf, "sasl.oauthbearer.token.endpoint.url", url);
+
+        rd_kafka_conf_set_error_cb(conf, auth_error_cb);
+
+        testid = test_id_generate();
+
+        c1 = test_create_consumer("OIDC.fail.C1", NULL, conf, NULL);
+
+        test_consumer_poll_no_msgs("OIDC.fail.C1", c1, testid, 5 * 1000);
+
+        TEST_ASSERT(error_seen);
+
+        test_consumer_close(c1);
+        rd_kafka_destroy(c1);
+        SUB_TEST_PASS();
+}
+
+/**
+ * @brief After config OIDC, if the token endpoint is not valid, make sure the
  *        authentication fail as expected.
  *
  */
-static void do_test_produce_consumer_with_OIDC_should_fail(
+static void
+do_test_produce_consumer_with_OIDC_should_fail_invalid_token_endpoint(
     const rd_kafka_conf_t *base_conf) {
         rd_kafka_t *c1;
         uint64_t testid;
@@ -183,6 +233,266 @@ static void do_test_produce_consumer_with_OIDC_should_fail(
         SUB_TEST_PASS();
 }
 
+typedef enum oidc_configuration_jwt_bearer_variation_t {
+        /** Use a private key file. */
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_FILE,
+        /** Use an encrypted private key file. */
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_FILE_ENCRYPTED,
+        /** Use a private key file
+         *  set as a configuration property. */
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_STRING,
+        /** Use an encrypted private key file
+         *  set as a configuration property. */
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_STRING_ENCRYPTED,
+        /** Use a private key file
+         *  and a template for the JWT assertion. */
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_TEMPLATE_FILE,
+        /** Use a private key file and set the JOSE algorithm to ES256.
+         *  This variation will fail as the private key is RSA in trivup  */
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_JOSE_ALGORITHM_ES256,
+        /** Invalid scope */
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_INVALID_SCOPE,
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION__CNT
+} oidc_configuration_jwt_bearer_variation_t;
+
+#define OIDC_CONFIGURATION_JWT_BEARER_VARIATION__FIRST_FAILING                 \
+        OIDC_CONFIGURATION_JWT_BEARER_VARIATION_JOSE_ALGORITHM_ES256
+
+static const char *oidc_configuration_jwt_bearer_variation_name(
+    oidc_configuration_jwt_bearer_variation_t variation) {
+        rd_assert(
+            variation >=
+                OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_FILE &&
+            variation < OIDC_CONFIGURATION_JWT_BEARER_VARIATION__CNT);
+        static const char *names[] = {
+            "private key file",       "private key encrypted file",
+            "private key pem string", "private key encrypted pem string",
+            "template file",          "JOSE algorithm ES256",
+            "invalid scope"};
+        return names[variation];
+}
+
+static rd_kafka_conf_t *oidc_configuration_jwt_bearer(
+    rd_kafka_conf_t *conf,
+    oidc_configuration_jwt_bearer_variation_t variation) {
+        char file_content[4096];
+        const char *private_key_file =
+            test_getenv("OAUTHBEARER_CLIENT_PRIVATE_KEY", NULL);
+        const char *private_key_encrypted_file =
+            test_getenv("OAUTHBEARER_CLIENT_PRIVATE_KEY_ENCRYPTED", NULL);
+        const char *private_key_password =
+            test_getenv("OAUTHBEARER_CLIENT_PRIVATE_KEY_PASSWORD", NULL);
+
+        conf = rd_kafka_conf_dup(conf);
+        test_conf_set(conf, "sasl.oauthbearer.grant.type",
+                      "urn:ietf:params:oauth:grant-type:jwt-bearer");
+        /* "sub" isn't mandatory if already defined in the template. */
+        if (variation != OIDC_CONFIGURATION_JWT_BEARER_VARIATION_TEMPLATE_FILE)
+                test_conf_set(conf, "sasl.oauthbearer.assertion.claim.sub",
+                              "testuser");
+        else
+                test_conf_set(conf,
+                              "sasl.oauthbearer.assertion.jwt.template.file",
+                              TEST_FIXTURES_JWT_ASSERTION_TEMPLATE);
+
+        if (variation ==
+            OIDC_CONFIGURATION_JWT_BEARER_VARIATION_JOSE_ALGORITHM_ES256)
+                test_conf_set(conf, "sasl.oauthbearer.assertion.algorithm",
+                              "ES256");
+        if (variation == OIDC_CONFIGURATION_JWT_BEARER_VARIATION_INVALID_SCOPE)
+                test_conf_set(conf, "sasl.oauthbearer.scope", "invalid_scope");
+
+        switch (variation) {
+        case OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_FILE:
+        case OIDC_CONFIGURATION_JWT_BEARER_VARIATION_TEMPLATE_FILE:
+        case OIDC_CONFIGURATION_JWT_BEARER_VARIATION_JOSE_ALGORITHM_ES256:
+        case OIDC_CONFIGURATION_JWT_BEARER_VARIATION_INVALID_SCOPE:
+                if (!private_key_file)
+                        goto fail;
+
+                test_conf_set(conf,
+                              "sasl.oauthbearer.assertion.private.key.file",
+                              private_key_file);
+                break;
+        case OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_FILE_ENCRYPTED:
+                if (!private_key_encrypted_file || !private_key_password)
+                        goto fail;
+                test_conf_set(conf,
+                              "sasl.oauthbearer.assertion.private.key.file",
+                              private_key_encrypted_file);
+                test_conf_set(
+                    conf, "sasl.oauthbearer.assertion.private.key.passphrase",
+                    private_key_password);
+                break;
+        case OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_STRING:
+                if (!private_key_file)
+                        goto fail;
+                TEST_ASSERT(test_read_file(private_key_file, file_content,
+                                           sizeof(file_content)) > 0);
+
+                test_conf_set(conf,
+                              "sasl.oauthbearer.assertion.private.key.pem",
+                              file_content);
+                break;
+        case OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_STRING_ENCRYPTED:
+                if (!private_key_encrypted_file || !private_key_password)
+                        goto fail;
+                TEST_ASSERT(test_read_file(private_key_file, file_content,
+                                           sizeof(file_content)) > 0);
+
+                test_conf_set(conf,
+                              "sasl.oauthbearer.assertion.private.key.pem",
+                              file_content);
+                test_conf_set(
+                    conf, "sasl.oauthbearer.assertion.private.key.passphrase",
+                    private_key_password);
+                break;
+        default:
+                rd_assert(!*"Unknown OIDC JWT bearer test variation");
+        }
+        return conf;
+fail:
+        rd_kafka_conf_destroy(conf);
+        TEST_WARN("Skipping OIDC JWT bearer test variation: %s",
+                  oidc_configuration_jwt_bearer_variation_name(variation));
+        return NULL;
+}
+
+void do_test_produce_consumer_with_OIDC_jwt_bearer(rd_kafka_conf_t *conf) {
+        rd_kafka_conf_t *jwt_bearer_conf;
+        oidc_configuration_jwt_bearer_variation_t variation;
+        for (variation =
+                 OIDC_CONFIGURATION_JWT_BEARER_VARIATION_PRIVATE_KEY_FILE;
+             variation < OIDC_CONFIGURATION_JWT_BEARER_VARIATION__CNT;
+             variation++) {
+                const char *test_name;
+                jwt_bearer_conf =
+                    oidc_configuration_jwt_bearer(conf, variation);
+                if (!jwt_bearer_conf)
+                        continue;
+
+                test_name = tsprintf(
+                    "JWT bearer: %s\n",
+                    oidc_configuration_jwt_bearer_variation_name(variation));
+
+                if (variation <
+                    OIDC_CONFIGURATION_JWT_BEARER_VARIATION__FIRST_FAILING)
+                        do_test_produce_consumer_with_OIDC(test_name,
+                                                           jwt_bearer_conf);
+                else
+                        do_test_produce_consumer_with_OIDC_should_fail(
+                            test_name, jwt_bearer_conf);
+                rd_kafka_conf_destroy(jwt_bearer_conf);
+        }
+}
+
+
+typedef enum oidc_configuration_metadata_authentication_variation_t {
+        /** Azure IMDS. Successful case. */
+        OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_SUCCESS,
+        /** Azure IMDS. Missing client ID. */
+        OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_MISSING_CLIENT_ID,
+        /** Azure IMDS. Missing resource parameter. */
+        OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_MISSING_RESOURCE,
+        /** Azure IMDS. Missing API version. */
+        OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_MISSING_API_VERSION,
+        OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION__CNT
+} oidc_configuration_metadata_authentication_variation_t;
+
+#define OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION__FIRST_FAILING    \
+        OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_MISSING_CLIENT_ID
+
+static const char *oidc_configuration_metadata_authentication_variation_name(
+    oidc_configuration_metadata_authentication_variation_t variation) {
+        rd_assert(
+            variation >=
+                OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_SUCCESS &&
+            variation <
+                OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION__CNT);
+        static const char *names[] = {
+            "Azure IMDS: success", "Azure IMDS: missing client ID",
+            "Azure IMDS: missing resource", "Azure IMDS: missing API version"};
+        return names[variation];
+}
+
+static rd_kafka_conf_t *oidc_configuration_metadata_authentication(
+    rd_kafka_conf_t *conf,
+    oidc_configuration_metadata_authentication_variation_t variation) {
+        conf = rd_kafka_conf_dup(conf);
+        switch (variation) {
+        case OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_SUCCESS:
+                test_conf_set(conf,
+                              "sasl.oauthbearer.metadata.authentication.type",
+                              "azure_imds");
+                test_conf_set(conf, "sasl.oauthbearer.config",
+                              "query=__metadata_authentication_type=azure_imds&"
+                              "api-version=2025-04-07&resource="
+                              "api://external_resource_id&client_id=client_id");
+                break;
+        case OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_MISSING_CLIENT_ID:
+                test_conf_set(conf,
+                              "sasl.oauthbearer.metadata.authentication.type",
+                              "azure_imds");
+                test_conf_set(conf, "sasl.oauthbearer.config",
+                              "query=__metadata_authentication_type=azure_imds&"
+                              "api-version=2025-04-07&resource="
+                              "api://external_resource_id");
+                break;
+        case OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_MISSING_RESOURCE:
+                test_conf_set(conf,
+                              "sasl.oauthbearer.metadata.authentication.type",
+                              "azure_imds");
+                test_conf_set(conf, "sasl.oauthbearer.config",
+                              "query=__metadata_authentication_type=azure_imds&"
+                              "api-version=2025-04-07&"
+                              "client_id=client_id");
+                break;
+        case OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_MISSING_API_VERSION:
+                test_conf_set(conf,
+                              "sasl.oauthbearer.metadata.authentication.type",
+                              "azure_imds");
+                test_conf_set(conf, "sasl.oauthbearer.config",
+                              "query=__metadata_authentication_type=azure_imds&"
+                              "resource="
+                              "api://external_resource_id&client_id=client_id");
+                break;
+        default:
+                TEST_ASSERT(rd_false,
+                            "Unknown OIDC metadata authentication type");
+        }
+        return conf;
+}
+
+/* Test metadata-based authentication cases against Trivup. */
+void do_test_produce_consumer_with_OIDC_metadata_authentication(
+    rd_kafka_conf_t *conf) {
+        rd_kafka_conf_t *metadata_authentication_conf;
+        oidc_configuration_metadata_authentication_variation_t variation;
+        for (
+            variation =
+                OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION_AZURE_IMDS_SUCCESS;
+            variation <
+            OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION__CNT;
+            variation++) {
+                const char *test_name;
+                metadata_authentication_conf =
+                    oidc_configuration_metadata_authentication(conf, variation);
+
+                test_name = tsprintf(
+                    "Metadata authentication variation: %s\n",
+                    oidc_configuration_metadata_authentication_variation_name(
+                        variation));
+
+                if (variation <
+                    OIDC_CONFIGURATION_METADATA_AUTHENTICATION_VARIATION__FIRST_FAILING)
+                        do_test_produce_consumer_with_OIDC(
+                            test_name, metadata_authentication_conf);
+                else
+                        do_test_produce_consumer_with_OIDC_should_fail(
+                            test_name, metadata_authentication_conf);
+                rd_kafka_conf_destroy(metadata_authentication_conf);
+        }
+}
 
 int main_0126_oauthbearer_oidc(int argc, char **argv) {
         rd_kafka_conf_t *conf;
@@ -194,18 +504,23 @@ int main_0126_oauthbearer_oidc(int argc, char **argv) {
         sec = test_conf_get(conf, "security.protocol");
         if (!strstr(sec, "sasl")) {
                 TEST_SKIP("Apache Kafka cluster not configured for SASL\n");
+                rd_kafka_conf_destroy(conf);
                 return 0;
         }
 
         oidc = test_conf_get(conf, "sasl.oauthbearer.method");
         if (rd_strcasecmp(oidc, "OIDC")) {
                 TEST_SKIP("`sasl.oauthbearer.method=OIDC` is required\n");
+                rd_kafka_conf_destroy(conf);
                 return 0;
         }
 
-        do_test_produce_consumer_with_OIDC(conf);
-        do_test_produce_consumer_with_OIDC_should_fail(conf);
+        do_test_produce_consumer_with_OIDC("client_credentials", conf);
+        do_test_produce_consumer_with_OIDC_should_fail_invalid_token_endpoint(
+            conf);
         do_test_produce_consumer_with_OIDC_expired_token_should_fail(conf);
+        do_test_produce_consumer_with_OIDC_jwt_bearer(conf);
+        do_test_produce_consumer_with_OIDC_metadata_authentication(conf);
 
         rd_kafka_conf_destroy(conf);