Repository navigation
Support Azure managed identity authentication for the Event Hubs sink #2647
Description
Problem
The Azure Event Hubs sink creates its EventHubProducerClient through EventHubClientBuilder.connectionString(...), so the supported configuration path requires an Event Hubs SAS connection string.
This prevents a Debezium Server workload running in Azure Container Apps, AKS, a VM, or another Azure-hosted environment from using its managed identity to authenticate to Event Hubs. Operators must instead provision, distribute, and rotate a SAS secret.
Request
Please add first-class Azure Entra ID authentication for the Event Hubs sink, implemented with the Azure Identity SDK and DefaultAzureCredential.
A possible configuration shape:
debezium.sink.eventhubs.auth.mode=default-azure-credential
debezium.sink.eventhubs.fully-qualified-namespace=<namespace>.servicebus.windows.net
debezium.sink.eventhubs.hubname=<event-hub-name>The existing connection-string configuration should remain supported and be the default for backward compatibility. A user-assigned managed identity could rely on the standard AZURE_CLIENT_ID environment variable consumed by Azure Identity.
The Entra-authenticated path would build the producer with EventHubClientBuilder.credential(namespace, hubName, credential). Operators would grant the workload identity the Azure Event Hubs Data Sender role at namespace or individual-hub scope.
Why
This enables secretless, least-privilege deployments using normal Azure RBAC. It eliminates the operational burden and exposure of Event Hubs SAS connection strings.
Existing extension point
EventHubsChangeConsumer accepts a CDI @CustomConsumerBuilder producer. A custom JAR/image can therefore implement this today, but every adopter must package and maintain Java code merely to create an Azure Identity-backed producer. Native configuration would make this a supported deployment model.
Relevant source
- Default SAS producer construction and the CDI customization hook:
https://github.com/debezium/debezium-server/blob/main/debezium-server-eventhubs/src/main/java/io/debezium/server/eventhubs/EventHubsChangeConsumer.java - Current Event Hubs sink configuration:
https://github.com/debezium/debezium-server/blob/main/debezium-server-eventhubs/src/main/java/io/debezium/server/eventhubs/EventHubsChangeConsumerConfig.java
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
Naros commentedon Sep 17, 2026
Hi @jomaxso this is a very reasonable improvement. Would you be open to supplying a PR?
abhi-roop commentedon Sep 21, 2026
Hi @Naros, I'd be happy to work on this.
I'm thinking of adding a
debezium.sink.eventhubs.auth.modeproperty, withconnection-stringas the default so the existing setup continues to work. I'd then add adefault-azure-credentialoption using Azure Identity'sDefaultAzureCredential.For the Entra ID flow, I'll use
EventHubClientBuilder.credential(namespace, hubName, credential)and add validation for the namespace and hub name. I'll also add tests and update the Event Hubs documentation with the new configuration and authentication setup.Does that approach sound good for the PR, or is there anything you'd like me to change before I start?
jomaxso commentedon Sep 21, 2026
@Naros I don't have the time right now to work on this so I would appreciate it when @abhi-roop can work on this. :)
debezium/dbz#2647 feat(eventhubs): add Azure managed identity authent…
abhi-roop commentedon Sep 22, 2026
PR opened: debezium/debezium-server#318
debezium/dbz#2647 Add Abhiroop Kumar Singh to COPYRIGHT.txt
debezium/dbz#2647 Document Azure managed identity authentication for …
debezium/dbz#2647 Add Abhiroop Kumar Singh to COPYRIGHT.txt
debezium/dbz#2647 Address review feedback on Event Hubs docs
debezium/dbz#2647 Remove blank line in Event Hubs docs table
debezium/dbz#2647 Address review feedback on Event Hubs sink
debezium/dbz#2647 Document AZURE_CLIENT_ID for user-assigned managed …
debezium/dbz#2647 Remove blank line in Event Hubs docs table
debezium/dbz#2647 Document AZURE_CLIENT_ID for user-assigned managed …
debezium/dbz#2647 Address second round of review feedback