Motivation

Enable clients to specify a destination with an oauth2 cloud-auth module that handles OAuth token fetching and refresh logic.

Currently, the only OAuth2 support in syslog-ng is inside the azure-auth module, which is Azure-specific and cannot be used with other cloud providers. This limits the destinations syslog-ng can target with OAuth2 tokens.
Apart from that, if new cloud-provider specific implementations were needed, we'd have code duplication when adding new OAuth2-based authenticators.

Changes

This PR introduces a generic OAuth2 authentication module that implements the client credentials flow with configurable authentication methods (HTTP Basic Auth or POST body credentials). The module provides a reusable foundation for cloud service authenticators that use OAuth2.

Key Features:

• Token fetching, caching, and automatic refresh based on expiry
• Configurable authentication method via auth-method() parameter
• Support for optional scope, resource, and authorization_details parameters
• Extensible via virtual methods for service-specific customization

Implementation Details:

• New generic OAuth2 module (oauth2-auth.{h,hpp,cpp}):

  • Handles all common OAuth2 client credentials flow logic
  • Reduces code duplication across cloud auth modules

• Refactored Azure module (azure-auth.{h,hpp,cpp}):

  • Now inherits from the generic OAuth2Authenticator
  • Maintains 100% backward compatibility with existing configurations
  • Eliminates duplicated logic from azure-auth module

Configuration

Using the new generic OAuth2 module:

destination d_http_oauth2 {
  http(
    url("https://api.example.com/logs")
    cloud-auth(
      oauth2(
        client-id("your-client-id")
        client-secret("your-secret")
        token-url("https://login.example.com/oauth2/token")
        scope("https://api.example.com/.default")
        auth-method("post-body")  # or "basic"
      )
    )
  );
};

Existing Azure configuration (unchanged):

destination d_azure {
  http(
    url("https://...")
    cloud-auth(
      azure(
        monitor(
          tenant-id("...")
          app-id("...")
          app-secret("...")
          scope("...")
        )
      )
    )
  );
};

Testing

• Verified the new generic OAuth2 module by targeting an HTTP endpoint
• Verified Azure authentication still works and successfully fetches OAuth2 tokens from Azure
• Verified token fetching, caching, and refresh work correctly

Notes

• The generic OAuth2 module is designed to be extended by future authenticators
• No breaking changes to existing configurations
• News file added: news/feature-5571.md
  Solves: Generic OAuth cloud module #5571