Kafka supports SASL/PLAIN, SCRAM-SHA-256 and SCRAM-SHA-512, but none should be treated as a substitute for transport encryption. Configure clients to use security.protocol=SASL_SSL, then select a SASL mechanism that the broker listener enables. PLAIN sends a username and password within the SASL exchange; SCRAM uses a challenge-response exchange. Kafka’s guidance requires TLS for both.
PLAIN or SCRAM: what changes?
| Aspect | SASL/PLAIN | SCRAM-SHA-256 or SCRAM-SHA-512 |
|---|---|---|
| Authentication exchange | Uses a username and password in a simple SASL exchange. Without TLS, the password is not protected in transit. | Uses a challenge-response exchange. Kafka still requires TLS to protect the exchange from interception. |
| Client mechanism | PLAIN |
SCRAM-SHA-256 or SCRAM-SHA-512 |
| Client login module | org.apache.kafka.common.security.plain.PlainLoginModule |
org.apache.kafka.common.security.scram.ScramLoginModule |
| Credential setup | Configure the broker’s PLAIN authentication and credential handling; Kafka documents callback-handler options for external credential sources. | Provision SCRAM credentials in the credential store appropriate to the Kafka version and deployment mode. |
| Transport security | TLS is required to prevent clear passwords from being sent unencrypted. | TLS is required to prevent interception of SCRAM exchanges. |
These mechanisms authenticate a client; they do not by themselves grant access to topics or groups. Kafka authorization uses the authenticated principal in ACL configuration. See the Kafka 4.3 Security Overview for the broader security model.
As an Amazon Associate I earn from qualifying purchases.
Configure a Kafka client
Set the client’s transport protocol, SASL mechanism and JAAS login configuration together. The following examples use placeholders, not usable credentials. Supply the actual secret through a protected configuration or secret-management system rather than committing it to source control.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →SASL/PLAIN
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="<username>" password="<password>";SCRAM-SHA-256
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-256
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="<username>" password="<password>";SCRAM-SHA-512
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="<username>" password="<password>";Replace the angle-bracketed values with credentials provisioned for the selected mechanism. The client-property form of sasl.jaas.config lets separate Kafka client instances in one JVM use different credentials. Kafka also supports static JAAS configuration; follow the documentation for the client and Kafka release in use.
Configure the broker to match
Client properties alone do not enable authentication. Broker listeners must use SASL, and each listener must enable the mechanism clients will request. Configure the broker’s JAAS settings and ensure their credentials or credential source match the chosen mechanism. Listener-and-mechanism-prefixed broker JAAS configuration takes precedence over static JAAS sections, according to Kafka’s documentation.
If brokers authenticate to one another over SASL, configure the inter-broker security protocol and mechanism as well. Those settings are distinct from client-facing listener configuration; ensure the inter-broker mechanism is enabled and its credentials are provisioned on every relevant broker. Setting names and supported combinations can vary with Kafka version and deployment mode, so use the guide for the exact release rather than copying a configuration from another version.
Rank #2
- Franz Kafka, German, Bohemian, Novel Author, 20th Century, Literature, Realism, Fantastic, Existenzangst, Guilt, Absurdity, Die Metamorphosis, Der Prozess, Das Schloss Kafkaesque, Literature, Artist, Writing, Book, Books, Fiction,
- Gift for writer, cockroach, insect,
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Provision SCRAM credentials with the right Kafka version
Kafka 4.3 documents the metadata log as the default SCRAM credential store. It provides kafka-storage.sh and kafka-configs.sh for creating SCRAM credentials. The correct command and timing depend on whether the cluster is being formatted or is already running, and on the deployment mode; use the corresponding procedure in the Kafka 4.3 SASL authentication guide.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDo not assume older instructions apply unchanged: older Kafka releases used ZooKeeper-based SCRAM storage. Confirm the deployed release and mode before provisioning or planning credential rotation. For SCRAM security considerations, Kafka 4.3 specifies a minimum iteration count of 4096; this is a configuration requirement, not a performance or protection guarantee.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose and verify a secure configuration
- Use
SASL_SSLand configure TLS certificates and trust appropriately. Kafka explicitly says PLAIN should be used only with SSL/TLS so clear passwords are not transmitted without encryption; it likewise says SCRAM should be used only with TLS to prevent interception of exchanges. - Check that the client’s mechanism exactly matches one enabled on the broker listener.
- Verify that the broker has the needed JAAS configuration and that credentials are provisioned for the chosen mechanism.
- Keep secrets out of example files, source control and logs. For PLAIN, Kafka documents callback-handler options for obtaining or checking credentials against external sources.
- Test authentication and authorization separately: a successful login does not mean the principal has permission to read, write or administer a resource.
Kafka’s full mechanism, client, listener and credential-store guidance is in its SASL authentication documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
