Authentication verifies that a Kafka participant is who it claims to be. Participants include producers, consumers, brokers, controllers, Kafka Connect, and Schema Registry; authentication is distinct from authorization and encryption. section 9.3.1
Kafka leaves security disabled by default and enables authentication through configuration rather than application-code changes. Common mechanisms include mTLS and SASL, selected according to exposure, performance, and operational complexity. section 9.0 section 9.3.1
Customer 360 ODS security plan
A Customer 360 deployment uses mTLS between clients and brokers because that traffic crosses more exposed boundaries and needs both identity verification and encryption. It uses SASL_PLAINTEXT for broker-controller and inter-broker traffic inside a segmented private network, accepting lower overhead in exchange for reduced protection of internal traffic. Certificates, network controls, and ACLs complete the operational design. section 9.3.6 section 9.2.3
Figure 9.10 Overview of the security features supported in Kafka
Use the security overview to map authentication to authorization, encryption, and the Kafka communication paths it protects. section 9.3.1
