adc-streaming 2.5.0__tar.gz → 2.7.0__tar.gz

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/.github/workflows/build.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
     - name: Check out the code

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/Makefile

@@ -32,7 +32,7 @@ lint :
 # stop the build if there are Python syntax errors or undefined names
 	flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
 # exit-zero treats all errors as warnings
-	flake8 . --count --exit-zero --max-complexity=10 --max-line-length=100 --statistics
+	flake8 . --count --exit-zero --max-complexity=20 --max-line-length=100 --statistics
 
 .PHONY: format
 format :

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: adc-streaming
-Version: 2.5.0
+Version: 2.7.0
 Summary: Astronomy Data Commons streaming client libraries
 Home-page: https://github.com/astronomy-commons/adc-streaming
 Author: Astronomy Data Commons Team
@@ -12,8 +12,35 @@ Classifier: Development Status :: 3 - Alpha
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Operating System :: MacOS :: MacOS X
 Description-Content-Type: text/markdown
-Provides-Extra: dev
 License-File: LICENSE
+Requires-Dist: confluent-kafka>=2.11.0
+Requires-Dist: dataclasses; python_version < "3.7"
+Requires-Dist: importlib-metadata; python_version < "3.8"
+Requires-Dist: tqdm
+Requires-Dist: certifi>=2020.04.05.1
+Requires-Dist: typing-extensions; python_version < "3.8"
+Provides-Extra: dev
+Requires-Dist: autopep8; extra == "dev"
+Requires-Dist: docker; extra == "dev"
+Requires-Dist: flake8; extra == "dev"
+Requires-Dist: isort; extra == "dev"
+Requires-Dist: pytest; extra == "dev"
+Requires-Dist: pytest-timeout; extra == "dev"
+Requires-Dist: pytest-integration; extra == "dev"
+Requires-Dist: sphinx; extra == "dev"
+Requires-Dist: sphinx_rtd_theme; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: summary
 
 # Astronomy Data Commons Streaming Client Libraries
 

adc_streaming-2.7.0/adc/auth.py

@@ -0,0 +1,147 @@
+#!/usr/bin/env python
+
+import base64
+from collections.abc import Mapping
+from enum import Enum
+import json
+import logging
+import subprocess
+
+import certifi
+
+logger = logging.getLogger("adc-streaming.auth")
+
+
+class SASLMethod(Enum):
+    """SASL method to use for authentication.
+    """
+
+    PLAIN = 1
+    SCRAM_SHA_256 = 2
+    SCRAM_SHA_512 = 3
+    OAUTHBEARER = 4
+
+    def __str__(self):
+        return self.name.replace("_", "-")
+
+
+class SASLAuth(object):
+    """Attach SASL-based authentication to a client.
+
+    Returns client-based auth options when called.
+
+    Parameters
+    ----------
+    user : `str`
+        Username to authenticate with.
+    password : `str`
+        Password to authenticate with.
+    ssl : `bool`, optional
+        Whether to enable SSL (enabled by default).
+    method : `SASLMethod`, optional
+        The SASL method to authenticate. The default is SASLMethod.OAUTHBEARER
+        if token_endpoint is provided, or SASLMethod.PLAIN otherwise.
+        See valid SASL methods in SASLMethod.
+    ssl_ca_location : `str`, optional
+        If using SSL via a self-signed cert, a path/location
+        to the certificate.
+    ssl_endpoint_identification_algorithm : `str`, optional
+        If using SSL, the algorithm used to verify that certificate is valid for the endpoint.
+    token_endpoint : `str`, optional
+        The OpenID Connect token endpoint URL.
+        Required for OAUTHBEARER / OpenID Connect, otherwise ignored.
+
+    """
+
+    def __init__(self, user, password, ssl=True, method=None, token_endpoint=None, **kwargs):
+        if method is None:
+            if token_endpoint is not None or "token_command" in kwargs:
+                method = SASLMethod.OAUTHBEARER
+            else:
+                method = SASLMethod.PLAIN
+
+        self._method = method
+
+        # set up SSL options
+        if ssl:
+            if "ssl_ca_location" in kwargs:
+                ssl_cert = kwargs["ssl_ca_location"]
+            else:
+                ssl_cert = certifi.where()
+
+            self._config = {
+                "security.protocol": "SASL_SSL",
+                "ssl.ca.location": ssl_cert,
+                "https.ca.location": ssl_cert,
+            }
+            if "ssl_endpoint_identification_algorithm" in kwargs:
+                self._config["ssl.endpoint.identification.algorithm"] = \
+                    kwargs["ssl_endpoint_identification_algorithm"]
+        else:
+            self._config = {"security.protocol": "SASL_PLAINTEXT"}
+
+        # set up SASL options
+        self._config["sasl.mechanism"] = str(self._method)
+        if method == SASLMethod.OAUTHBEARER:
+            if token_endpoint is not None:
+                self._config["sasl.oauthbearer.client.id"] = user
+                self._config["sasl.oauthbearer.client.secret"] = password
+                self._config["sasl.oauthbearer.method"] = "oidc"
+                self._config["sasl.oauthbearer.token.endpoint.url"] = token_endpoint
+            elif "token_command" in kwargs:
+                token_command = kwargs["token_command"]
+                self._config["sasl.oauthbearer.method"] = "default"
+                self._config["oauth_cb"] = lambda c: SASLAuth.external_token_callback(token_command)
+        else:
+            self._config["sasl.username"] = user
+            self._config["sasl.password"] = password
+
+    @staticmethod
+    def external_token_callback(command):
+        try:
+            presult = subprocess.run(command, shell=True, capture_output=True)
+            if presult.returncode != 0:
+                raise RuntimeError("Token callback command failed: " + presult.stderr)
+            rawdata = presult.stdout
+            # need to parse the resulting JWT enough to extract the expiration time
+            # we do no other validation, since downstream systems should be responsible
+            # for that already
+            sections = rawdata.split(b'.')
+            if len(sections) != 3:
+                raise RuntimeError("Token callback output does not appear to be a valid JWT")
+            try:
+                # The JWT spec mandates that base 64 padding be omitted, but
+                # base64.urlsafe_b64decode requires it, so we must put it back.
+                m = len(sections[1]) % 4
+                if m == 2:
+                    sections[1] += b"=="
+                elif m == 3:
+                    sections[1] += b"="
+                elif m == 1:
+                    raise RuntimeError("Token callback output is not valid base64 data")
+                claims = json.loads(base64.urlsafe_b64decode(sections[1]).decode("utf-8"))
+            except UnicodeDecodeError:
+                raise RuntimeError("Token callback output is not valid UTF-8 after base64 decoding")
+            except json.JSONDecodeError:
+                raise RuntimeError("Token callback output is not valid JSON after base64 and "
+                                   "UTF-8 decoding")
+            if not isinstance(claims, Mapping):
+                raise RuntimeError("Token callback output does not contain valid claims")
+            if "sub" not in claims:
+                raise RuntimeError("Token callback output does not contain an subject claim")
+            if "exp" not in claims:
+                raise RuntimeError("Token callback output does not contain an expiration claim")
+            exp_value = claims["exp"]
+            if not isinstance(exp_value, int) and not isinstance(exp_value, float):
+                raise RuntimeError("Token expiration value is not a number")
+            exp_value = float(exp_value)
+            try:
+                return (rawdata.decode("utf-8").strip(), exp_value, claims["sub"], {})
+            except UnicodeDecodeError:
+                raise RuntimeError("Token callback output is not valid UTF-8 data")
+        except Exception as ex:
+            logger.error(f"Token callback error: {ex}")
+            raise
+
+    def __call__(self):
+        return self._config

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/adc/consumer.py

@@ -14,7 +14,6 @@ import confluent_kafka.admin  # type: ignore
 
 from .auth import SASLAuth
 from .errors import ErrorCallback, log_client_errors
-from .oidc import set_oauth_cb
 
 
 class LogicalOffset(enum.IntEnum):
@@ -360,5 +359,4 @@ class ConsumerConfig:
 
         if self.auth is not None:
             config.update(self.auth())
-        set_oauth_cb(config)
         return config

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/adc/kafka.py

@@ -14,12 +14,12 @@ def parse_kafka_url(val):
     if parsed.scheme != "kafka":
         raise ValueError("invalid kafka URL: must start with 'kafka://'")
 
+    group_id = parsed.username
+    # intentionally ignore passwords embedded in URLs to discourage their use
     split_netloc = parsed.netloc.split("@", maxsplit=1)
     if len(split_netloc) == 2:
-        group_id = split_netloc[0]
         broker_addresses = split_netloc[1].split(",")
     else:
-        group_id = None
         broker_addresses = split_netloc[0].split(",")
 
     topics = parsed.path.lstrip("/")

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/adc/producer.py

@@ -14,7 +14,6 @@ import confluent_kafka  # type: ignore
 from .auth import SASLAuth
 from .errors import (DeliveryCallback, ErrorCallback, log_client_errors,
                      log_delivery_errors)
-from .oidc import set_oauth_cb
 
 
 class Producer:
@@ -48,11 +47,26 @@ class Producer:
                                 "Either configure a topic when constructing the Producer, "
                                 "or specify the topic argument to write()")
         self.logger.debug("writing message to %s", topic)
+        produce_kwargs = {"headers": headers, "key": key}
         if delivery_callback is not None:
-            self._producer.produce(topic, msg, headers=headers, key=key,
-                                   on_delivery=delivery_callback)
-        else:
-            self._producer.produce(topic, msg, headers=headers, key=key,)
+            produce_kwargs["on_delivery"] = delivery_callback
+        while True:
+            try:
+                self._producer.produce(topic, msg, **produce_kwargs)
+                break
+            except BufferError:
+                # It's hard to know what the size limit on the buffer is, so we will try to
+                # wait until the number of items in it decreases (or it is empty, in case all
+                # messages were successfully sent in the time it took to handle the error).
+                buffer_len = len(self._producer)
+                self.logger.debug(f"Blocking due to BufferError, buffer size: {buffer_len}")
+                while buffer_len > 0 and len(self._producer) == buffer_len:
+                    self._producer.poll(0.01)
+
+    def queued_message_count(self):
+        """Get the number of messages waiting to be sent to the broker.
+        """
+        return len(self._producer)
 
     def flush(self, timeout: timedelta = timedelta(seconds=10)) -> int:
         """Attempt to flush enqueued messages. Return the number of messages still
@@ -66,9 +80,9 @@ class Producer:
             self.logger.debug("flushed all messages")
         return n
 
-    def close(self) -> int:
+    def close(self, timeout: timedelta = timedelta(seconds=10)) -> int:
         self.logger.debug("shutting down producer")
-        return self.flush()
+        return self.flush(timeout)
 
     def __enter__(self) -> 'Producer':
         return self
@@ -142,7 +156,6 @@ class ProducerConfig:
             config["error_cb"] = self.error_callback
         if self.auth is not None:
             config.update(self.auth())
-        set_oauth_cb(config)
         return config
 
 

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/adc_streaming.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: adc-streaming
-Version: 2.5.0
+Version: 2.7.0
 Summary: Astronomy Data Commons streaming client libraries
 Home-page: https://github.com/astronomy-commons/adc-streaming
 Author: Astronomy Data Commons Team
@@ -12,8 +12,35 @@ Classifier: Development Status :: 3 - Alpha
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Operating System :: MacOS :: MacOS X
 Description-Content-Type: text/markdown
-Provides-Extra: dev
 License-File: LICENSE
+Requires-Dist: confluent-kafka>=2.11.0
+Requires-Dist: dataclasses; python_version < "3.7"
+Requires-Dist: importlib-metadata; python_version < "3.8"
+Requires-Dist: tqdm
+Requires-Dist: certifi>=2020.04.05.1
+Requires-Dist: typing-extensions; python_version < "3.8"
+Provides-Extra: dev
+Requires-Dist: autopep8; extra == "dev"
+Requires-Dist: docker; extra == "dev"
+Requires-Dist: flake8; extra == "dev"
+Requires-Dist: isort; extra == "dev"
+Requires-Dist: pytest; extra == "dev"
+Requires-Dist: pytest-timeout; extra == "dev"
+Requires-Dist: pytest-integration; extra == "dev"
+Requires-Dist: sphinx; extra == "dev"
+Requires-Dist: sphinx_rtd_theme; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: summary
 
 # Astronomy Data Commons Streaming Client Libraries
 

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/adc_streaming.egg-info/SOURCES.txt

@@ -12,13 +12,14 @@ adc/consumer.py
 adc/errors.py
 adc/io.py
 adc/kafka.py
-adc/oidc.py
 adc/producer.py
 adc_streaming.egg-info/PKG-INFO
 adc_streaming.egg-info/SOURCES.txt
 adc_streaming.egg-info/dependency_links.txt
 adc_streaming.egg-info/not-zip-safe
 adc_streaming.egg-info/requires.txt
+adc_streaming.egg-info/scm_file_list.json
+adc_streaming.egg-info/scm_version.json
 adc_streaming.egg-info/top_level.txt
 doc/Makefile
 doc/conf.py

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/adc_streaming.egg-info/requires.txt

@@ -1,6 +1,4 @@
-authlib
-confluent-kafka!=2.1.0,!=2.1.1,>=1.6.1
-requests
+confluent-kafka>=2.11.0
 tqdm
 certifi>=2020.04.05.1
 

adc_streaming-2.7.0/adc_streaming.egg-info/scm_file_list.json

@@ -0,0 +1,32 @@
+{
+  "files": [
+    ".github/workflows/build.yml",
+    ".gitignore",
+    "LICENSE",
+    "Makefile",
+    "README.md",
+    "adc/__init__.py",
+    "adc/auth.py",
+    "adc/consumer.py",
+    "adc/errors.py",
+    "adc/io.py",
+    "adc/kafka.py",
+    "adc/producer.py",
+    "doc/Makefile",
+    "doc/_static/css/my_theme.css",
+    "doc/_templates/layout.html",
+    "doc/api/api.rst",
+    "doc/api/streaming.rst",
+    "doc/conf.py",
+    "doc/index.rst",
+    "doc/user/installation.rst",
+    "doc/user/quickstart.rst",
+    "pyproject.toml",
+    "recipe/meta.yaml",
+    "setup.cfg",
+    "setup.py",
+    "tests/test_auth.py",
+    "tests/test_kafka.py",
+    "tests/test_kafka_integration.py"
+  ]
+}

adc_streaming-2.7.0/adc_streaming.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.6.0",
+  "distance": 5,
+  "node": "ge0095abe7c2bd5a1dce1a913653bdc084fcd2496",
+  "dirty": false,
+  "branch": "external-token-support",
+  "node_date": "2026-08-28"
+}

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/setup.py

@@ -3,11 +3,9 @@ from setuptools import setup
 
 # requirements
 install_requires = [
-    "authlib",  # FIXME: drop after next release of confluent-kafka with OIDC support
-    "confluent-kafka >= 1.6.1, != 2.1.0, != 2.1.1",
+    "confluent-kafka >= 2.11.0",
     "dataclasses ; python_version < '3.7'",
     "importlib-metadata ; python_version < '3.8'",
-    "requests",  # FIXME: drop after next release of confluent-kafka with OIDC support
     "tqdm",
     "certifi>=2020.04.05.1",
     "typing-extensions ; python_version < '3.8'",

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/tests/test_auth.py

@@ -28,7 +28,16 @@ from adc.auth import SASLAuth
             'sasl.password': 'test-pass',
             'security.protocol': 'SASL_SSL'
         }
-    ]
+    ],
+    [
+        SASLAuth(
+            'test', '', token_command="generate_token"
+        ),
+        {
+            'sasl.mechanism': 'OAUTHBEARER',
+            'sasl.oauthbearer.method': 'default',
+        }
+    ],
 ])
 def test_auth(auth, expected_config):
     # Check that the key/value pairs in expected_config are a subset

{adc-streaming-2.5.0 → adc_streaming-2.7.0}/tests/test_kafka_integration.py

@@ -5,7 +5,11 @@ import unittest
 from datetime import datetime, timedelta
 from typing import List, Optional
 
-import docker
+try:
+	import docker
+	have_docker = True
+except ImportError:
+	have_docker = False
 import pytest
 
 import adc.consumer
@@ -17,6 +21,7 @@ logging.getLogger("adc-streaming").setLevel(logging.DEBUG)
 logger = logging.getLogger("adc-streaming.tests")
 
 
+@pytest.mark.skipif(not have_docker, reason="requires docker")
 @pytest.mark.integration_test
 class KafkaIntegrationTestCase(unittest.TestCase):
     """This test runs a Kafka broker in a Docker container, and makes sure that
@@ -84,6 +89,44 @@ class KafkaIntegrationTestCase(unittest.TestCase):
         self.assertEqual(msg.value(), b"can you hear me?")
         self.assertEqual(msg.key(), b"test_msg")
 
+    def test_message_with_callback(self):
+        """Try writing a message into the Kafka broker, with a delivery callback.
+        """
+        topic = "test_message_with_callback"
+        callback_called = False
+        callback_error = False
+
+        def callback(err, msg):
+            nonlocal callback_called
+            nonlocal callback_error
+            callback_called = True
+            callback_error = err is not None
+
+        ap = adc.producer
+        with ap.Producer(ap.ProducerConfig(broker_urls=[self.kafka.address],
+                                           topic=topic, auth=self.kafka.auth)) as producer:
+            producer.write("message data", delivery_callback=callback)
+            producer.flush()
+            consumer = adc.consumer.Consumer(adc.consumer.ConsumerConfig(
+                broker_urls=[self.kafka.address],
+                group_id="test_consumer",
+                auth=self.kafka.auth,
+            ))
+            consumer.subscribe(topic)
+            stream = consumer.stream()
+
+            msg = next(stream)
+            if msg.error() is not None:
+                raise Exception(msg.error())
+            # give the producer's background thread time to notice the ack from the broker and
+            # fire the callback
+            producer._producer.poll(0.1)
+
+        self.assertEqual(msg.topic(), topic)
+        self.assertEqual(msg.value(), b"message data")
+        self.assertEqual(callback_called, True)
+        self.assertEqual(callback_error, False)
+
     def test_reset_to_end(self):
         # Write a few messages.
         topic = "test_reset_to_end"
@@ -486,7 +529,7 @@ class KafkaDockerConnection:
         """Block until the Docker daemon tells us the IP and Port of the Kafa broker.
 
         Returns the ip and port as a string in the form "ip:port."
-"""
+        """
         i = 0
         while (not self.query_kafka_broker_address()) and i < maxiter:
             logger.info("polling to wait for container to acquire port...")
@@ -508,7 +551,7 @@ class KafkaDockerConnection:
         port = addrs[0]['HostPort']
         return f"{ip}:{port}"
 
-    def poll_for_kafka_active(self, maxiter=20, sleep=timedelta(milliseconds=500)):
+    def poll_for_kafka_active(self, maxiter=40, sleep=timedelta(milliseconds=500)):
         """Block until Kafka's network listener is accepting connections."""
         i = 0
         while (not self.query_kafka_active()) and i < maxiter:

adc-streaming-2.5.0/adc/auth.py

@@ -1,86 +0,0 @@
-#!/usr/bin/env python
-
-from enum import Enum
-
-import certifi
-
-
-class SASLMethod(Enum):
-    """SASL method to use for authentication.
-    """
-
-    PLAIN = 1
-    SCRAM_SHA_256 = 2
-    SCRAM_SHA_512 = 3
-    OAUTHBEARER = 4
-
-    def __str__(self):
-        return self.name.replace("_", "-")
-
-
-class SASLAuth(object):
-    """Attach SASL-based authentication to a client.
-
-    Returns client-based auth options when called.
-
-    Parameters
-    ----------
-    user : `str`
-        Username to authenticate with.
-    password : `str`
-        Password to authenticate with.
-    ssl : `bool`, optional
-        Whether to enable SSL (enabled by default).
-    method : `SASLMethod`, optional
-        The SASL method to authenticate. The default is SASLMethod.OAUTHBEARER
-        if token_endpoint is provided, or SASLMethod.PLAIN otherwise.
-        See valid SASL methods in SASLMethod.
-    ssl_ca_location : `str`, optional
-        If using SSL via a self-signed cert, a path/location
-        to the certificate.
-    ssl_endpoint_identification_algorithm : `str`, optional
-        If using SSL, the algorithm used to verify that certificate is valid for the endpoint.
-    token_endpoint : `str`, optional
-        The OpenID Connect token endpoint URL.
-        Required for OAUTHBEARER / OpenID Connect, otherwise ignored.
-
-    """
-
-    def __init__(self, user, password, ssl=True, method=None, token_endpoint=None, **kwargs):
-        if method is None:
-            if token_endpoint is None:
-                method = SASLMethod.PLAIN
-            else:
-                method = SASLMethod.OAUTHBEARER
-        self._method = method
-
-        # set up SSL options
-        if ssl:
-            if "ssl_ca_location" in kwargs:
-                ssl_cert = kwargs["ssl_ca_location"]
-            else:
-                ssl_cert = certifi.where()
-
-            self._config = {
-                "security.protocol": "SASL_SSL",
-                "ssl.ca.location": ssl_cert,
-            }
-            if "ssl_endpoint_identification_algorithm" in kwargs:
-                self._config["ssl.endpoint.identification.algorithm"] = \
-                    kwargs["ssl_endpoint_identification_algorithm"]
-        else:
-            self._config = {"security.protocol": "SASL_PLAINTEXT"}
-
-        # set up SASL options
-        self._config["sasl.mechanism"] = str(self._method)
-        if token_endpoint:
-            self._config["sasl.oauthbearer.client.id"] = user
-            self._config["sasl.oauthbearer.client.secret"] = password
-            self._config["sasl.oauthbearer.method"] = "oidc"
-            self._config["sasl.oauthbearer.token.endpoint.url"] = token_endpoint
-        else:
-            self._config["sasl.username"] = user
-            self._config["sasl.password"] = password
-
-    def __call__(self):
-        return self._config

adc-streaming-2.5.0/adc/oidc.py

@@ -1,27 +0,0 @@
-def set_oauth_cb(config):
-    """Implement client support for KIP-768 OpenID Connect.
-
-    Apache Kafka 3.1.0 supports authentication using OpenID Client Credentials.
-    Native support for Python is still incomplete due to this issue:
-    https://github.com/confluentinc/librdkafka/issues/3751
-
-    Meanwhile, this is a pure Python implementation of the refresh token
-    callback.
-    """
-    if config.pop('sasl.oauthbearer.method', None) != 'oidc':
-        return
-
-    client_id = config.pop('sasl.oauthbearer.client.id')
-    client_secret = config.pop('sasl.oauthbearer.client.secret')
-    scope = config.pop('sasl.oauthbearer.scope', None)
-    token_endpoint = config.pop('sasl.oauthbearer.token.endpoint.url')
-
-    from authlib.integrations.requests_client import OAuth2Session
-    session = OAuth2Session(client_id, client_secret, scope=scope)
-
-    def oauth_cb(*_, **__):
-        token = session.fetch_token(
-            token_endpoint, grant_type='client_credentials')
-        return token['access_token'], token['expires_at']
-
-    config['oauth_cb'] = oauth_cb