Skip to main content

SASL

The Simple Authentication and Security Layer (SASL) is a framework for authentication in connection-oriented protocols. Apache Kafka supports several SASL mechanisms for client authentication, including GSSAPI (Kerberos), OAUTHBEARER, SCRAM, PLAIN, delegation tokens, and LDAP.

Kafka Gateway currently supports:

  • PLAIN: username and password sent as plaintext, always paired with TLS.
  • SCRAM: username and password protected by a salted challenge-response exchange.
  • OAuthBearer: a short-lived OAuth 2.0 bearer token, sourced from a guard.

Configuring the Connection

SASL credentials are set on options.authorization of the kafka client binding, sourced from a named guard:

options:
  servers:
    - kafka:9092
  authorization:
    my_guard:
      credentials:
        mechanism: plain
        username: "{identity}"
        password: "{credentials}"

Deprecated

The older options.sasl static credential block still works for plain and scram-* mechanisms, but is deprecated in favor of options.authorization. oauthbearer is only available through options.authorization.

See the kafka client binding reference for the full set of supported mechanisms. SASL only authenticates the connection; pair it with TLS to also encrypt it.