How deeply does Kafka for Architects cover principal?

Connects identity derivation, SASL authentication, ACL structure, and quota targeting, with configuration examples but no implementation internals.

Principal

As explained in Kafka for Architects

A principal is an identity representing a client, broker, user, or service in a security system.

A principal is the authenticated identity of a participant in a secure Kafka system. It can represent a client, broker, user, or service, and it becomes the identity used for authorization and resource governance. section 9.3.3 section 9.3.4

Kafka derives and uses principals in several security workflows:

Derives an mTLS principal from a TLS certificate, using the full distinguished name by default or mapped fields such as the common name. section 9.3.3
Associates a user principal with authenticated client requests, allowing quotas to be assigned consistently at the user level. section 3.1.5
Places the principal in ACL rules that grant or deny operations on topics, consumer groups, clusters, transactions, and other resources. section 9.3.4

Authentication establishes the principal; authorization evaluates what that identity may do. ACLs combine the principal with a resource, operation, permission, pattern, and host. Deny rules take precedence over allow rules, and consumer permissions may include offset commits, group operation, and metadata access in addition to reading. section 9.3.3 section 9.3.4

Constraining a service principal

An ACL can allow User:card-service to write to resources beginning with the CARDS topic pattern, while also granting Create. The authenticated principal provides a stable identity for this rule; client.id alone is less reliable because applications or frameworks can choose it arbitrarily. section 3.1.5 section 9.3.4

Table 9.1 Security protocols supported by Kafka

Security protocol	Encryption	Authentication	Description
PLAINTEXT	No	No	Unencrypted communication with no authentication
SASL_PLAINTEXT	No	Yes (via SASL)	Uses SASL for authentication but does not encrypt data
SSL	Yes (TLS)	Yes (via TLS)	Encrypts communication and supports TLS-based authentication
SASL_SSL	Yes (TLS)	Yes (via SASL)	Uses SASL for authentication and TLS for encryption

Compare Kafka security protocols to distinguish authentication through SASL or TLS from transport encryption. section 9.3.3

How Kafka for Architects covers it

liveBook manning.com

Read Kafka for Architects on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Authorization in ActionA principal is an entity, such as a person, machine, or process, that can initiate an action in an authorization system.
liveBook manning.com

Azure SecurityA security principal is an identity or identity-bearing entity, such as a user, group, service principal, or managed identity, that can receive permissions in an authorization system.
liveBook manning.com

Microsoft Azure in ActionA security principal is an identity-bearing object, such as a user, group, or application, that can request access to an Azure resource.
liveBook manning.com

Apache Kafka in ActionA principal is the authenticated security identity representing a user or system when accessing protected resources.

Compare how 5 books explain principal →

Related concepts

role assignmentpart of · A role assignment is an access-control configuration that grants a principal an authorization role or specified permissions for a defined scope.
PARC modelpart of · The PARC model is an authorization framework that describes an access decision using a principal, action, resource, and conditions or context.
ClaimsPrincipalimplemented by · ClaimsPrincipal is a .NET security class representing a principal through one or more identities and their associated claims.
policy templateused by · A policy template is a reusable authorization policy structure containing placeholders that are filled with specific principals, resources, or other values later.
subjectcontrasts with · A subject is an entity designated as the focus of representation, data modeling, or an authorization policy.
role-based access controluses · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.

This explainer was generated by Manning's knowledge graph from the text of Kafka for Architects. The section links point to the parts of the book it draws on.