Build an authenticator extension

The OpenTelemetry Collector allows you to connect receivers and exporters to authenticators so you can authenticate incoming connections at the receiver side and add authentication data to outgoing requests at the exporter side.

Authenticators are implemented through extensions. This document guides you on implementing your own authenticators. If you want to learn how to use an existing authenticator, see the documentation for that specific authenticator. You can find a list of existing authenticators in the registry on this website.

Use this guide for general directions on how to build a custom authenticator and see the API Reference Guide for the semantics of each type and function.

If you need help, join the #opentelemetry-collector-dev channel at the CNCF Slack workspace.

Architecture

Authenticators in OpenTelemetry are just like any other extension, but they also have to implement one or more specific interfaces that define how authentication is performed (for example, authenticating HTTP or gRPC requests). Use server authenticators with receivers to intercept HTTP and gRPC requests. Use client authenticators with exporters to add authentication data to HTTP and gRPC requests. Authenticators can also implement both interfaces at the same time, allowing a single instance of the extension to handle both incoming and outgoing requests.

Once an authenticator extension is available in a Collector distribution, you can reference it in the configuration file the same as other extensions. However, an authenticator is effective only when it’s referenced by a consuming component. The following configuration shows a receiver named otlp/auth using the oidc authenticator extension:

extensions:
  oidc:

receivers:
  otlp/auth:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317
        auth:
          authenticator: oidc

processors:
exporters:

service:
  extensions:
    - oidc
  pipelines:
    traces:
      receivers:
        - otlp/auth