Skip to main content

SASL and Kerberos Configuration Examples

PLAIN Authentication Example

UI Configuration:

  • SASL Mechanism: PLAIN

  • Security Protocol: SASL_PLAINTEXT or SASL_SSL

  • JAAS Configuration:

    org.apache.kafka.common.security.plain.PlainLoginModule required username="kafkauser" password="kafkapass";

Complete JAAS String:

org.apache.kafka.common.security.plain.PlainLoginModule required username="kafkauser" password="kafkapass";

SCRAM-SHA-256 Authentication Example

UI Configuration:

  • SASL Mechanism: SCRAM-SHA-256

  • Security Protocol: SASL_PLAINTEXT or SASL_SSL

  • JAAS Configuration:

    org.apache.kafka.common.security.scram.ScramLoginModule required username="kafkauser" password="kafkapass";

Complete JAAS String:

org.apache.kafka.common.security.scram.ScramLoginModule required username="kafkauser" password="kafkapass";

OAUTHBEARER Authentication Example

UI Configuration:

  • SASL Mechanism: OAUTHBEARER

  • Security Protocol: SASL_SSL

  • JAAS Configuration:

    org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required unsecuredLoginPrincipalClaimName="sub" unsecuredLoginStringClaim_sub="kafkauser";

Additional Kafka SASL Properties

Property Key

Property Value

sasl.login.refresh.window.factor

0.8

sasl.login.refresh.window.jitter

0.05

sasl.login.refresh.min.period.seconds

60

sasl.login.refresh.min.buffer.seconds

300

Complete JAAS String:

org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required unsecuredLoginPrincipalClaimName="sub" unsecuredLoginStringClaim_sub="kafkauser";

Kerberos (GSSAPI) Authentication Example

UI Configuration:

  • SASL Mechanism: GSSAPI

  • Security Protocol: SASL_PLAINTEXT or SASL_SSL

  • JAAS Configuration:

    com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true keyTab="/etc/security/keytabs/kafka.service.keytab" principal="kafka/mooghost.example.com@EXAMPLE.COM";

Kerberos Configuration:

  • Enable Kerberos Debug Logging: true (for troubleshooting)

  • Kerberos Service Name: kafka

  • Kerberos Configuration File Path: /etc/krb5.conf

Example krb5.conf:

[libdefaults]
    default_realm = EXAMPLE.COM
    dns_lookup_realm = false
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true

[realms]
    EXAMPLE.COM = {
        kdc = kdc1.example.com
        kdc = kdc2.example.com
        admin_server = kdc1.example.com
    }

[domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM

Complete JAAS String:

com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true keyTab="/etc/security/keytabs/kafka.service.keytab" principal="kafka/mooghost.example.com@EXAMPLE.COM";

SSL/TLS Configuration Example

UI Configuration:

  • Use SSL: true

  • Truststore Location: /path/to/kafka.client.truststore.jks

  • Truststore Password: truststorepassword

  • Keystore Location: /path/to/kafka.client.keystore.jks

  • Keystore Password: keystorepassword

  • Key Password: keypassword

  • SSL Endpoint Identification Algorithm: HTTPS

Combined SSL and SASL Configuration Examples

PLAIN Authentication with SSL:

Kerberos Authentication with SSL

  • Security Protocol: SASL_SSL

  • SSL Settings: Configure as described in the SSL/TLS Configuration Example.

  • SASL Settings: Configure as described in the Kerberos (GSSAPI) Authentication Example.

Advanced Configuration Examples

Custom JAAS Module

If you use a custom login module, configure the JAAS string as follows:

com.example.security.CustomLoginModule required customParam1="value1" customParam2="value2";

Multi-Realm Kerberos

For environments with multiple Kerberos realms:

com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true keyTab="/etc/security/keytabs/kafka.service.keytab" principal="kafka/mooghost.realm1.com@REALM1.COM";

OAuth with Token Refresh

For OAuth Bearer authentication with automatic token refresh:

org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required unsecuredLoginPrincipalClaimName="sub" unsecuredLoginStringClaim_sub="service-account" unsecuredLoginTokenClaim="access_token";

Additional Properties

Property Key

Property Value

sasl.login.refresh.window.factor

0.85

sasl.login.refresh.window.jitter

0.03

sasl.login.refresh.min.period.seconds

30

sasl.login.refresh.min.buffer.seconds

240

In this section: