Refactor Kafka authentication using strategy and template method patterns

[Copilot]

Description

Spring Cloud Azure's Kafka authentication implementation was scattered across multiple packages with duplicated logic. Two authentication methods exist: OAuth2/OAUTHBEARER (recommended, uses Azure Identity) and connection string-based SASL_PLAIN (deprecated). The implementation lacked clear separation of concerns and was difficult to extend.

This PR refactors the implementation using both Strategy Pattern and Template Method Pattern to consolidate common logic and make both authentication methods follow a consistent structure.

Changes

Strategy Pattern Introduction

• Created KafkaAuthenticationConfigurer interface for authentication strategies
• Extracted OAuth2 logic into OAuth2AuthenticationConfigurer
• Created ConnectionStringAuthenticationConfigurer for connection string authentication
• Refactored AbstractKafkaPropertiesBeanPostProcessor to delegate to configurers

Template Method Pattern Implementation

• Created AbstractKafkaAuthenticationConfigurer as template base class
• Extracted common validation logic: bootstrap server checks, SASL protocol validation, property getters
• Both OAuth2AuthenticationConfigurer and ConnectionStringAuthenticationConfigurer extend the template
• Eliminated code duplication between authentication strategies

Documentation

• Added kafka/README.md covering architecture, authentication methods, and migration guide
• Enhanced Javadoc with usage examples and configuration patterns
• Documented template method pattern with class hierarchy and extension points
• Documented deprecated connection string approach with migration path

Code Organization

• Consolidated authentication detection and configuration logic
• Improved separation: detection → configuration → cleanup phases
• Made authentication methods explicit and extensible
• Updated eventhubs.kafka.KafkaPropertiesBeanPostProcessor to use ConnectionStringAuthenticationConfigurer

Architecture

KafkaAuthenticationConfigurer (interface)
    ↑
AbstractKafkaAuthenticationConfigurer (template)
    ↑                           ↑
OAuth2AuthenticationConfigurer  ConnectionStringAuthenticationConfigurer

Authentication Methods

OAuth2/OAUTHBEARER (Recommended)

spring.kafka.bootstrap-servers=namespace.servicebus.windows.net:9093
spring.cloud.azure.credential.managed-identity-enabled=true

Connection String (Deprecated)

spring.cloud.azure.eventhubs.connection-string=Endpoint=sb://...

Impact

• 5 new files: strategy interface, template base class, OAuth2 implementation, ConnectionString implementation, documentation
• 4 modified files: enhanced docs, refactored to use strategy and template patterns
• +770 lines (including documentation), -84 lines

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

• Fixes [FEATURE REQ] Refactor Kafka support in Spring Cloud Azure #47196

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[FEATURE REQ] Refactor Kafka support in Spring Cloud Azure</issue_title>
<issue_description>Now there are two authentication methods support in Spring Cloud Azure, one SASL plain, another is SASL connection string. The first will use the Event Hubs connection string, the second will use Microsoft Entra ID to auth.

But the implementation in Spring Cloud Azure is not consistent, and scattered in different autoconfiguration or BeanPostProcessors.

Describe the solution you'd like
Refactor the implemenataion to make the code easy to read and understand.

Describe alternatives you've considered
N/A
Additional context
N/A

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Description Added
• Expected solution specified
  </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [FEATURE REQ] Refactor Kafka support in Spring Cloud Azure #47196

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[saragluna]

There should be annother ConnectionStringAuthenticationConfigurer, and it's also a strategy, the common logic should be extracted to a common template. @copilot

[saragluna]

@copilot, there should be annother ConnectionStringAuthenticationConfigurer, and it's also a strategy, the common logic should be extracted to a common template.

[Copilot]

Done! I've created ConnectionStringAuthenticationConfigurer as a strategy and extracted common logic into AbstractKafkaAuthenticationConfigurer template class.

Changes:

• AbstractKafkaAuthenticationConfigurer - Template base with common validation logic (bootstrap server checks, SASL protocol validation, property getters)
• ConnectionStringAuthenticationConfigurer - Implements connection string auth strategy
• OAuth2AuthenticationConfigurer - Refactored to extend the template
• Both configurers now share common code and follow the same structure

Commit: b001273 (documentation update), e241088 (implementation)

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• oss.jfrog.org
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.11/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.11/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.11 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.11/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/azure-sdk-for-java/azure-sdk-for-java/sdk/spring/spring-cloud-azure-autoconfigure org.codehaus.plexus.classworlds.launcher.Launcher clean compile (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)