# Ingestion Authentication with OAuth2 Credential Token

To enable authentication for ingestion using OAuth2 credentials, perform these steps:

-  Configure Okta and Deployment Site](https://docs.kloudfuse.com/platform/3.3.6/ingestion-authentication-oauth2-credential-token/#okta)
-  Configure OpenTelemetry Collector](https://docs.kloudfuse.com/platform/3.3.6/ingestion-authentication-oauth2-credential-token/#otel)

|     |     |
| --- | --- |
|  | You cannot directly add labels that are based on the auth key when using an `oauth2` credential token.<br>To attach labels, you must configure this on the agent. |

##  Configure Okta and Deployment Site

1. Configure Okta by consulting OAuth2 Proxy documentation [Okta](https://oauth2-proxy.github.io/oauth2-proxy/7.3.x/configuration/oauth_provider/#okta), Steps 1 through 3.
   
   In Step 3, under **General**, set the **Allowed grant types** to **_Authorization Code_**, **_Refresh Token_**, and also **_Client Credentials_**.
   
   While setting up Okta, note the Client ID, Client Secret, Audience, and Issuer URI values.

2. Configure your deployment `custom-values.yaml` file.

```yaml
   kfuse-auth:
        ingestOauthEnabled: true
        oauth2-proxy:
          extraArgs:
            extra-jwt-issuers: "Issuer URI=Audience" (1)
   ```
   
   |     |     |
   | --- | --- |
   | **1** | `Issuer URI=Audience`: Replace both `Issuer URI` and `Audience` with values from your Okta configuration; for example `extra-jwt-issuers: "https://{okta-domain}.okta.com/oauth2/default=api://your-audience-id"` |

##  Configure OpenTelemetry Collector

Follow these steps to configure the OpenTelemetry Collector, and enable it to send data securely using OAuth2 authentication. Then update the `custom-values.yaml` file using these configuration details.

1. Configure Exporters.

Add the following code to the `opentelemetry-collector.config.exporters` section.
   
   It defines the endpoints where the OpenTelemetry Collector sends metrics and traces.
   
   
   ```yaml
   opentelemetry-collector:
        config:
          exporters:
            otlphttp/{deployment-namespace}: (1)
              metrics_endpoint: https://<kloudfuse-url>/ingester/oauth2/otlp/metrics (2)
              traces_endpoint: https://<kloudfuse-url>/ingester/oauth2/otlp/traces
              logs_endpoint : https://<kloudfuse-url>/ingester/oauth2/otlp/v1/logs
              auth:
                authenticator: oauth2client
   ```
   
   |     |     |
   | --- | --- |
   | **1** | `{deployment-namespace}`: The namespace where the Kloudfuse stack is installed. |
   | **2** | `<kloudfuse-url>`: Change the placeholder to the URL of your Kloudfuse instance. |

2. Add the required extensions.

Include the `oauth2client` in the `service.extensions` section.
   
   
   ```yaml
   service:
        extensions:
     - oauth2client
   ```
   
3. Configure extensions.
   
   ```
   Set up the detailed configurations for the extensions. Add the `oauth2client` configuration to the `extensions` section.
   ```
   
   ```yaml
   extensions:
        oauth2client:
          client_id: <client-id> (1)
          client_secret: <client-secret> (2)
          token_url: https://{okta-url}.okta.com/oauth2/default/v1/token (3)
          endpoint_params:
            response_type: code
            prompt: none
            access_type: offline
            grant_type: client_credentials
          scopes: ["api.metrics"]
   ```
   
   |     |     |
   | --- | --- |
   | **1** | `client-id`: Change the placeholder to your client id. |
   | **2** | `client-secret`: Change the placeholder to your client secret. |
   | **3** | `okta-url`: Change the placeholder to your Okta URL. |

4. Set up Pipelines.

Specify how to process and export metrics, traces, and logs.
   
   Add the following information to the `opentelemetry-collector.config.service.pipelines` section.
   
   ```yaml
   opentelemetry-collector:
        config:
          service:
            pipelines:
              metrics:
                exporters:
             - otlphttp/{deployment-namespace}
            traces:
              exporters:
              - otlphttp/{deployment-namespace}
            logs:
              exporters:
              - otlphttp/{deployment-namespace}
   ```