Client authentication configuration in Kafka - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is client authentication in Kafka?

Client authentication in Kafka is the process of verifying the identity of a client (producer or consumer) before allowing access to the Kafka cluster.

beginner

Name two common methods for client authentication in Kafka.

Two common methods are SSL (using certificates) and SASL (Simple Authentication and Security Layer) mechanisms like PLAIN or SCRAM.

intermediate

What configuration property is used to enable SSL client authentication in Kafka?

The property 'ssl.client.auth' is used to require client authentication over SSL. Setting it to 'required' enforces client certificate verification.

intermediate

How do you configure SASL authentication for a Kafka client?

You set 'security.protocol' to a SASL protocol like 'SASL_SSL' and configure 'sasl.mechanism' (e.g., PLAIN or SCRAM), along with credentials in JAAS config.

beginner

Why is client authentication important in Kafka?

It protects the Kafka cluster by ensuring only authorized clients can connect, preventing unauthorized data access or manipulation.

Which Kafka property enables client certificate verification over SSL?

A ssl.client.auth

B security.protocol

C sasl.mechanism

D ssl.keystore.location

The 'ssl.client.auth' property controls whether client certificates are required for SSL connections.

What value should 'security.protocol' have to use SASL with SSL in Kafka?

A PLAINTEXT

B SSL

C SASL_SSL

D SASL_PLAINTEXT

'SASL_SSL' means SASL authentication over an SSL encrypted connection.

Which SASL mechanism is NOT commonly used in Kafka client authentication?

A OAUTHBEARER

B SCRAM

C GSSAPI

D PLAIN

While OAUTHBEARER is supported in newer Kafka versions, it is less common compared to PLAIN, SCRAM, and GSSAPI.

What is the purpose of the JAAS configuration in Kafka client authentication?

A To specify SSL certificates

B To define broker addresses

C To set Kafka topic permissions

D To configure SASL login credentials

JAAS config provides the username and password or other credentials for SASL authentication.

If 'ssl.client.auth' is set to 'none', what happens?

A Client certificates are required

B Client certificates are not requested

C Client certificates are optional

D SSL is disabled

'none' means the server does not request client certificates during SSL handshake.

Explain how to configure Kafka client authentication using SSL certificates.

Think about how SSL certificates prove identity and how Kafka uses keystores.

Describe the steps to set up SASL authentication for a Kafka client.

Focus on protocol, mechanism, and credentials.