SASL is a standardized framework that separates client authentication from the application protocol. In Kafka, a client selects a mechanism, presents credentials, and proceeds only after the broker verifies its identity. SASL can run over unencrypted TCP or TLS; authentication and encryption are separate concerns. section 9.3.3 section 9.0
Kafka supports several SASL mechanisms, each suited to a different authentication environment:
- PLAIN uses username-and-password credentials and requires TLS for secure deployment. section 9.3.3
- SCRAM-SHA-256 and SCRAM-SHA-512 provide hashed password authentication. section 9.3.3
- GSSAPI integrates Kerberos, OAUTHBEARER uses tokens such as OAuth 2.0, and cloud-specific mechanisms support provider authentication. section 9.3.3
SASL with TLS for a Kafka client
A client configured with security.protocol=SASL_SSL, sasl.mechanism=PLAIN, and a JAAS configuration file combines SASL authentication with TLS encryption. The broker must enable the corresponding mechanism and authentication configuration. section 9.3.3
Table 9.1 Security protocols supported by Kafka
| Security protocol |
Encryption |
Authentication |
Description |
| PLAINTEXT |
No |
No |
Unencrypted communication with no authentication |
| SASL_PLAINTEXT |
No |
Yes (via SASL) |
Uses SASL for authentication but does not encrypt data |
| SSL |
Yes (TLS) |
Yes (via TLS) |
Encrypts communication and supports |
| SASL_SSL |
Yes (TLS) |
Yes (via SASL) |
Uses SASL for authentication and TLS for encryption |
Compare Kafka security protocols by whether they provide encryption, authentication, or both. section 9.3.3
