Setting up Connection to Kafka

SASL/PLAIN is a simple authentication mechanism that sends the username and password (base64-encoded). It is the simplest SASL method but requires SSL/TLS for security over the network.

Configure the Kafka Connection Profile with PLAIN authentication:

JAAS Config string format:

org.apache.kafka.common.security.plain.PlainLoginModule required
username="<username>"
password="<password>";

Replace <username> and <password> with valid credentials configured on the Kafka broker.

For Confluent Cloud Kafka, use the API Key as the username and API Secret as the password:

SASL/GSSAPI uses Kerberos for authentication --- an enterprise-grade, ticket-based authentication protocol. It provides strong security without sending passwords over the network.

JAAS Config string format:

com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
keyTab="/etc/security/keytabs/kafka-client.keytab"
principal="kafka-client@EXAMPLE.COM";

Replace the keyTab and principal values with your actual client keytab path and Kerberos principal.

SASL/SCRAM-SHA-256 (Salted Challenge Response Authentication Mechanism) is a secure password-based authentication that does not send passwords over the network. It is more secure than SASL/PLAIN and simpler than Kerberos.

JAAS Config string format:

org.apache.kafka.common.security.scram.ScramLoginModule required
username="<username>"
password="<password>";

Replace <username> and <password> with valid credentials configured on the Kafka broker.

SASL/SCRAM-SHA-512 is identical to SCRAM-SHA-256 but uses the SHA-512 hashing algorithm, providing stronger cryptographic security with longer hash outputs.

JAAS Config string format:

org.apache.kafka.common.security.scram.ScramLoginModule required
username="<username>"
password="<password>";

Replace <username> and <password> with valid credentials configured on the Kafka broker.

Kafka supports combining SASL-based authentication with SSL/TLS encryption to ensure both secure identity verification and encrypted communication. Enable the Use SSL toggle along with any SASL mechanism (PLAIN, SCRAM_SHA_256, SCRAM_SHA_512, or GSSAPI).

Step 1: Create a Certificate Authority (CA)

# Generate CA private key
openssl genrsa -aes256 -out ca-key.pem 4096
# Create self-signed CA certificate
openssl req -x509 -new -key ca-key.pem -sha256 -days 1826 -out ca-cert.pem

Step 2: Create and sign a Server Certificate

Sample configuration

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
C = US
ST = State
L = City
O = Organization
OU = OrgUnit
CN = kafka-server

[v3_req]
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth,clientAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = kafka-server
DNS.3 = your-hostname.com
IP.1 = 127.0.0.1
IP.2 = 192.168.1.100

NOTE : In alt_names section add the IP or the Domain where the server is hosted

Sample configuration

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth,clientAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = kafka-server
DNS.3 = your-hostname.com
IP.1 = 127.0.0.1
IP.2 = 192.168.1.100

openssl x509 -req -in server.csr \
-CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial \
-out server.crt -days 825 -sha256 -extfile server.ext

Step 3: Create Server Keystore and Truststore

# Keystore
openssl pkcs12 -export -in server.crt -inkey server.key -certfile ca-cert.pem \
-out server.keystore.p12 -name kafka-server
keytool -importkeystore -deststorepass <pass> -destkeypass <pass> \
-destkeystore server.keystore.jks -srckeystore server.keystore.p12 \
-srcstoretype PKCS12 -srcstorepass <p12-pass> -alias kafka-server
# Truststore
keytool -import -alias myCA -file ca-cert.pem -keystore server.truststore.jks

Step 4: Configure Kafka Broker for mTLS (server.properties):

listeners=SSL://localhost:9093
ssl.keystore.location=/path/to/kafka.server.keystore.jks
ssl.keystore.password=serverpass
ssl.key.password=serverkeypass
ssl.truststore.location=/path/to/kafka.server.truststore.jks
ssl.truststore.password=truststorepass
ssl.client.auth=required

Step 5: Create a Client Certificate for Striim and configure the Kafka Connection Profile:

openssl genpkey -algorithm RSA -out client.key -aes256
openssl req -new -key client.key -out client.csr
openssl x509 -req -in client.csr -CA ca-cert.pem -CAkey ca-key.pem \
-CAcreateserial -out client.crt -days 365 -sha256

Rotated certificates are used by adapters when the adapter encounters an exception and retries, or on application restart. To rotate certificates:

Prerequisites:

Steps: