pulsar

Pulsar authentication Oauth2 only supports 'client_credentials' grant type. There is no 'token-excha ge' grant (which is useful in setups similar to Google wif).  Any suggestions on this

Yes, it's a gap on the client side. Client Credentials flow and Client TLS Authentication flow are currently supported.
On the broker side, it should be possible to configure AuthenticationProviderOpenID to validate the JWT token.

Claude says that Google WIF requires some additional step since it doesn't return a JWT token by default. According to Claude, the additional step to get a JWT token:
"Impersonate a service account and call `generateIdToken`. The result is a JWT with issuer `<https://accounts.google.com>` and a public JWKS, which works with `AuthenticationProviderOpenID`."

Alternative approach: *Exchange against your own IdP.* Keycloak, Dex or similar can federate the external identity and issue its own JWT. Then you only trust one issuer on the brokers.

I wanted to know that, is it worth it to have token-exchange grant type in pulsar OAuth2 lib, RFC 8693.