Utpilla/add bearer token extension

rust/otap-dataflow/Cargo.toml

@@ -216,6 +216,10 @@ unchecked-arithmetic = []
 # Experimental features
 experimental-tls = ["otap-df-otap/experimental-tls", "dep:rustls"]
 
+# Contrib extensions (opt-in) - now in contrib-nodes
+contrib-extensions = ["otap-df-contrib-nodes/contrib-extensions"]
+azure-identity-auth-extension = ["otap-df-contrib-nodes/azure-identity-auth-extension"]
+bearer-token-auth-extension = ["otap-df-contrib-nodes/bearer-token-auth-extension"]
 # Contrib exporters (opt-in) - now in contrib-nodes
 contrib-exporters = ["otap-df-contrib-nodes/contrib-exporters"]
 geneva-exporter = ["otap-df-contrib-nodes/geneva-exporter"]

rust/otap-dataflow/configs/otlp-bearer-auth.yaml

@@ -0,0 +1,47 @@
+# OTLP Receiver with Bearer Token Auth Extension
+#
+# This configuration demonstrates server-side authentication using the
+# bearer_token_auth extension. The extension validates that incoming
+# gRPC requests carry an `Authorization: Bearer <token>` header matching
+# the configured static token; requests without a valid token are rejected
+# with gRPC UNAUTHENTICATED status.
+
+version: otel_dataflow/v1
+engine: { }
+
+groups:
+  default:
+    pipelines:
+      main:
+        policies:
+          channel_capacity:
+            control:
+              node: 100
+              pipeline: 100
+            pdata: 128
+
+        nodes:
+          # Extension node: provides server-side auth for receivers.
+          # Extensions are regular nodes identified by their URN prefix.
+          # They are started before pipeline components and stopped after.
+          bearer_auth:
+            type: "urn:otel:extension:bearer_token_auth"
+            config:
+              token: "my-secret-token"
+
+          receiver:
+            type: receiver:otlp
+            config:
+              # Reference the auth extension by its node name.
+              # The standardized `auth.authenticator` field mirrors the
+              # Go Collector's configauth.Authentication pattern.
+              auth:
+                authenticator: "bearer_auth"
+              protocols:
+                grpc:
+                  listening_addr: "127.0.0.1:4317"
+
+          exporter:
+            type: exporter:debug
+            config:
+              verbosity: basic

rust/otap-dataflow/crates/contrib-nodes/Cargo.toml

@@ -50,6 +50,20 @@ reqwest = { workspace = true, optional = true, features = ["rustls"] }
 sysinfo = { workspace = true, optional = true }
 
 [features]
+contrib-extensions = [
+    "azure-identity-auth-extension",
+    "bearer-token-auth-extension",
+]
+azure-identity-auth-extension = [
+    "dep:azure_identity",
+    "dep:azure_core",
+    "dep:http",
+    "dep:rand",
+]
+bearer-token-auth-extension = [
+    "dep:http",
+]
+
 contrib-exporters = [
     "geneva-exporter",
     "azure-monitor-exporter",
@@ -60,9 +74,7 @@ geneva-exporter = [
 ]
 azure-monitor-exporter = [
     "dep:opentelemetry-proto",
-    "dep:azure_identity",
     "dep:reqwest",
-    "dep:azure_core",
     "dep:ahash",
     "dep:sysinfo",
     "dep:chrono",