OAuth 2.0 Client Auth Extension design doc

[pritishnahar95]

Change Summary

Adds a design doc for a proposed OAuth 2.0 Client Auth extension (urn:otel:extension:oauth2_client_auth) — the generic, provider-neutral counterpart to the Azure Identity Auth extension, modeled on the Go collector's oauth2clientauthextension.

The extension acquires and background-refreshes OAuth 2.0 access tokens (client-credentials + JWT-bearer grants) and exposes them to data-path nodes through the existing BearerTokenProvider capability — so the OTLP exporters can inject a refreshed Authorization: Bearer header without embedding static credentials or doing token work on the hot path.

Key design points covered:

• Reuses the existing BearerTokenProvider capability (no new capability machinery).
• Active + Shared execution, watch-based token cache, slow-path coalescing via fetch_lock, background refresh with expiry_buffer, jittered scheduling + bounded exponential-backoff retry.
• Readiness-gated startup (blocks data-path spawn until the first token is published, bounded by startup_timeout.
• Token-endpoint TLS via the shared otap_df_config::tls::TlsClientConfig; custom CA, mTLS client cert, SNI.
• Config schema, telemetry, lifecycle, security/performance considerations, validation expectations, and open questions.

What issue does this PR close?

• Related to Feature request: OAuth 2.0 Client Auth extension (BearerTokenProvider) #3479

How are these changes tested?

n/a

Are there any user-facing changes?

no

Changelog

• Added a .chloggen/*.yaml entry
• This PR is a chore (indicated in title)
• This is a documentation-only PR.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Status last refreshed: 2026-07-26 00:04:13 UTC.

• Waiting on: Maintainers
• Next step: Merge when ready.

This automated status or its linked feedback items may be incorrect. If something looks wrong, please report it with the result you expected.

[Copilot]

Pull request overview

Adds a draft design document for a proposed urn:otel:extension:oauth2_client_auth extension in rust/otap-dataflow, describing a provider-neutral OAuth2 token acquisition/refresh component that would expose tokens via the existing BearerTokenProvider capability for use by OTLP exporters.

Changes:

• Added a new design doc covering goals, architecture, configuration schema, lifecycle, telemetry, and security/performance considerations for an OAuth 2.0 client auth extension.
• Documented intended integration points with the engine extension lifecycle (Active + Shared, readiness gating) and consumer usage patterns (fast-path cache, watch-based stream).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.87%. Comparing base (89b1f1b) to head (6b75e36).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3571      +/-   ##
==========================================
- Coverage   86.88%   86.87%   -0.01%     
==========================================
  Files         782      782              
  Lines      319341   319341              
==========================================
- Hits       277444   277439       -5     
- Misses      41373    41378       +5     
  Partials      524      524              

Components	Coverage Δ
otap-dataflow	87.94% <ø> (-0.01%)	⬇️
query_engine	89.57% <ø> (ø)
otel-arrow-go	52.45% <ø> (ø)
quiver	92.20% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[drewrelmas]

Looks good to me! Excited to see the generic implementation coming in!

[lalitb]

Moved out from merge queue, as @pritishnahar95 is making some updates to align the design with the Azure identity extension.