properties + sec: broker properties updates

modules/develop/partials/http-proxy.adoc

@@ -899,6 +899,52 @@ pretty(res)
 --
 =====
 
+=== OIDC Authentication
+
+If HTTP Proxy is configured to support OIDC, you can provide an OIDC token in the Authorization header. For example:
+
+[tabs]
+=====
+curl::
++
+--
+[,bash]
+----
+curl -s -H "Authorization: Bearer <oidc-token>" "<host-address>:8082/topics"
+----
+
+--
+NodeJS::
++
+--
+[,javascript]
+----
+let options = {
+  headers: { Authorization: `Bearer <oidc-token>` },
+};
+
+axios
+  .get(`${base_uri}/topics`, options)
+  .then(response => console.log(response.data))
+  .catch(error => console.log);
+----
+
+--
+Python::
++
+--
+[,python]
+----
+headers = {"Authorization": "Bearer <oidc-token>"}
+res = requests.get(f"{base_uri}/topics", headers=headers).json()
+pretty(res)
+----
+
+--
+=====
+
+For details about configuring OIDC authentication, see xref:manage:security/authentication.adoc#oidc-authentication[OIDC Authentication].
+
 == Use Swagger with HTTP Proxy
 
 You can use Swagger UI to test and interact with Redpanda HTTP Proxy endpoints.

modules/get-started/pages/release-notes/redpanda.adoc

@@ -47,12 +47,7 @@ The `confluent-kafka-javascript` client is now validated with Redpanda. For a li
 
 == HTTP Proxy authentication changes
 
-[IMPORTANT]
-====
 include::shared:partial$http-proxy-ephemeral-credentials-breaking-change.adoc[tags=!*;include-config-link]
-====
-
-HTTP Proxy previously used automatically-generated ephemeral credentials to authenticate with the Kafka API when the HTTP Proxy listeners specified xref:reference:properties/broker-properties.adoc#http_proxy_auth_method[`authentication_method`]: `none`. To improve security and simplify the authentication model, ephemeral credentials are no longer available.
 
 If you need to maintain the current HTTP Proxy functionality while transitioning to authenticated clients, configure the following HTTP Proxy client properties in your `redpanda.yaml` configuration:
 

modules/manage/partials/authentication.adoc

@@ -657,10 +657,7 @@ endif::[]
 
 Schema Registry and HTTP Proxy connect to Redpanda over the Kafka API.
 
-[IMPORTANT]
-====
 include::shared:partial$http-proxy-ephemeral-credentials-breaking-change.adoc[tags=!*;include-release-notes-link]
-====
 
 Schema Registry and HTTP Proxy support only the SASL/SCRAM mechanism.
 
@@ -1793,10 +1790,7 @@ For all available endpoints, see xref:api:ROOT:pandaproxy-schema-registry.adoc[]
 
 To disable authentication for a listener, set xref:reference:properties/broker-properties.adoc#kafka_api_auth_method[`authentication_method`] broker property to `none`:
 
-[IMPORTANT]
-====
 include::shared:partial$http-proxy-ephemeral-credentials-breaking-change.adoc[tags=!*;include-release-notes-link]
-====
 
 ifdef::env-kubernetes[]
 [tabs]