Implementing Security
1. Understanding Kafka Security Model
| Pillar |
Description |
Mechanism |
| Encryption |
In-transit confidentiality |
SSL/TLS |
| Authentication |
Verify identity |
SSL/SASL |
| Authorization |
Access control |
ACLs |
Example: Security protocol
security.protocol=SASL_SSL # auth + encryption
2. Enabling SSL Encryption
| Config |
Description |
Detail |
| security.protocol |
SSL |
Encrypt only |
| listeners |
SSL://:9093 |
Secure port |
| Overhead |
CPU for TLS |
No zero-copy |
Example: Enable SSL
listeners=SSL://:9093
security.inter.broker.protocol=SSL
3. Configuring SSL Certificates
| Config |
Description |
Detail |
| ssl.keystore.location |
Server identity |
JKS/PKCS12 |
| ssl.truststore.location |
Trusted CAs |
Verify peers |
| CA-Signed |
Prod best practice |
Chain of trust |
Example: Certificate config
ssl.keystore.location=/etc/kafka/ssl/server.keystore.jks
ssl.truststore.location=/etc/kafka/ssl/server.truststore.jks
4. Setting Keystore Password
| Config |
Description |
Detail |
| ssl.keystore.password |
Keystore file password |
Required |
| ssl.key.password |
Private key password |
If different |
| Secrets |
Externalize via providers |
Not plaintext |
Warning: Avoid plaintext passwords in config; use a ConfigProvider or environment-based secret injection.
Example: Externalized password
ssl.keystore.password=${file:/etc/kafka/secrets.properties:keystore.pwd}
5. Configuring SSL Endpoint Identification
| Config |
Description |
Detail |
ssl.endpoint.
identification.algorithm |
Hostname verification |
https |
| Default |
https (enabled) |
Secure |
| Empty |
Disables check |
Risky |
Example: Hostname verification
ssl.endpoint.identification.algorithm=https
6. Enabling SASL Authentication
| Config |
Description |
Detail |
| security.protocol |
SASL_SSL / SASL_PLAINTEXT |
Auth |
| sasl.mechanism |
PLAIN/SCRAM/GSSAPI |
Method |
| JAAS |
Credentials config |
sasl.jaas.config |
Example: Enable SASL_SSL
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-256
7. Configuring SASL/PLAIN
| Aspect |
Description |
Detail |
| PLAIN |
Username/password |
Simple |
| TLS Required |
Must use SASL_SSL |
No plaintext creds |
| Static |
Users in JAAS |
No rotation |
Example: SASL/PLAIN JAAS
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule \
required username="app" password="secret";
8. Using SASL/SCRAM
| Aspect |
Description |
Detail |
| SCRAM |
Salted challenge-response |
SHA-256/512 |
| Storage |
Credentials in metadata |
kafka-configs |
| Rotation |
Add/update users live |
Dynamic |
Example: Create SCRAM user
kafka-configs.sh --bootstrap-server localhost:9092 --alter \
--add-config 'SCRAM-SHA-256=[password=secret]' \
--entity-type users --entity-name app
9. Configuring SASL/GSSAPI
| Aspect |
Description |
Detail |
| GSSAPI |
Kerberos auth |
Enterprise |
| Keytab |
Service principal creds |
useKeyTab |
| service.name |
Kerberos service |
kafka |
Example: GSSAPI JAAS
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \
useKeyTab=true keyTab="/etc/security/kafka.keytab" \
principal="kafka/host@REALM";
10. Setting Up SASL/OAUTHBEARER
| Aspect |
Description |
Detail |
| OAUTHBEARER |
OAuth 2.0 tokens |
OIDC |
| Token Endpoint |
IdP issues JWT |
sasl.oauthbearer |
| Refresh |
Auto token renewal |
Callback |
Example: OAuth config
sasl.mechanism=OAUTHBEARER
sasl.oauthbearer.token.endpoint.url=https://idp/token
sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler
11. Enabling Inter-Broker Security
| Config |
Description |
Detail |
security.inter.
broker.protocol |
Broker-to-broker |
SSL/SASL_SSL |
inter.broker.
listener.name |
Dedicated listener |
Alternative |
| Controller |
Secure controller listener |
KRaft |
Example: Inter-broker SSL
security.inter.broker.protocol=SSL