Client authentication configuration in Kafka - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this SASL/PLAIN client configuration?

Given the following Kafka client configuration snippet, what will be the SASL mechanism used when connecting?

Kafka

security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user1" password="pass1";

A SCRAM-SHA-256

B PLAIN

C GSSAPI

D OAUTHBEARER

💡 Hint

Look at the sasl.mechanism property to identify the authentication method.

The sasl.mechanism property explicitly sets the SASL mechanism to PLAIN, which means the client will use username and password authentication.

❓ Predict Output

intermediate

What error occurs with this incomplete JAAS config?

Consider this Kafka client JAAS configuration snippet: sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user1";

Kafka

security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user1";

A Authentication fails due to missing password

B SyntaxError: missing password in JAAS config

C Connection succeeds with username only

D RuntimeException: Unknown SASL mechanism

💡 Hint

The PlainLoginModule requires both username and password.

The JAAS config is missing the password parameter, so authentication will fail because the client cannot provide complete credentials.

🧠 Conceptual

advanced

Which Kafka client property enables SSL client authentication?

To configure Kafka client for SSL client authentication (mutual TLS), which property must be set to provide the client's private key and certificate?

A ssl.truststore.location

B ssl.enabled.protocols

C ssl.keystore.location

D ssl.client.auth

💡 Hint

The keystore contains the client's private key and certificate.

ssl.keystore.location points to the file containing the client's private key and certificate needed for SSL client authentication.

❓ Predict Output

advanced

What is the effect of this SASL/OAUTHBEARER config snippet?

Given this Kafka client configuration snippet: security.protocol=SASL_SSL sasl.mechanism=OAUTHBEARER sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;

Kafka

security.protocol=SASL_SSL
sasl.mechanism=OAUTHBEARER
sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;

A Client fails due to missing OAuth token

B Client uses username/password authentication

C Client uses Kerberos ticket for authentication

D Client uses OAuth 2.0 token for authentication

💡 Hint

OAUTHBEARER mechanism uses OAuth 2.0 tokens.

The OAUTHBEARER SASL mechanism configures the client to authenticate using OAuth 2.0 tokens via the specified callback handler.

🔧 Debug

expert

Why does this Kafka client fail to authenticate with SCRAM?

This Kafka client configuration fails to authenticate: security.protocol=SASL_PLAINTEXT sasl.mechanism=SCRAM-SHA-256 sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user1" password="pass1"; What is the most likely cause?

Kafka

security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-256
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="user1" password="pass1";

A Broker does not support SCRAM-SHA-256 mechanism

B Missing ssl.keystore.location property

C Using SASL_PLAINTEXT instead of SASL_SSL causes failure

D Incorrect username format in JAAS config

💡 Hint

Check if the Kafka broker supports the SASL mechanism configured.

If the broker does not support SCRAM-SHA-256, the client cannot authenticate even if the client config is correct.