SASL authentication in Kafka - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

SASL PLAIN Authentication Configuration Output

What will be the output of the following Kafka client configuration snippet when connecting with SASL PLAIN?

Kafka

props = {
  'security.protocol': 'SASL_PLAINTEXT',
  'sasl.mechanism': 'PLAIN',
  'sasl.jaas.config': 'org.apache.kafka.common.security.plain.PlainLoginModule required username="user1" password="pass1";'
}
print(props['security.protocol'], props['sasl.mechanism'])

A PLAINTEXT SASL_PLAIN

B SASL_PLAINTEXT PLAIN

C SASL_SSL PLAIN

D SSL SASL_PLAINTEXT

💡 Hint

Check the values assigned to 'security.protocol' and 'sasl.mechanism' keys.

The configuration sets 'security.protocol' to 'SASL_PLAINTEXT' and 'sasl.mechanism' to 'PLAIN', so printing these keys outputs 'SASL_PLAINTEXT PLAIN'.

❓ Predict Output

intermediate

SASL SCRAM Authentication Error Message

What error message will be raised if the Kafka client tries to connect using SASL SCRAM with an incorrect password?

Kafka

try:
  # Simulated connection attempt
  raise Exception('SASL authentication failed: Invalid credentials')
except Exception as e:
  print(e)

A No such mechanism supported

B Connection timeout error

C SASL authentication failed: Invalid credentials

D SSL handshake failed

💡 Hint

Focus on the exception message raised during authentication failure.

When SASL SCRAM authentication fails due to wrong password, the client typically receives an 'Invalid credentials' error message.

🔧 Debug

advanced

Identify the SASL Authentication Bug

Given the following Kafka client configuration, which option correctly identifies the bug causing SASL authentication to fail?

Kafka

props = {
  'security.protocol': 'SASL_SSL',
  'sasl.mechanism': 'PLAIN',
  'sasl.jaas.config': 'org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin123"'
}
# Connection fails with authentication error

A Missing semicolon at the end of 'sasl.jaas.config' string

B Incorrect 'security.protocol' value; should be 'PLAINTEXT'

C Wrong SASL mechanism; should be 'SCRAM-SHA-256'

D Username and password must be integers

💡 Hint

Check the syntax of the JAAS config string carefully.

The JAAS config string requires a semicolon at the end to separate statements. Missing it causes authentication failure.

📝 Syntax

advanced

SASL JAAS Configuration Syntax Error

Which option contains a syntax error in the SASL JAAS configuration string?

A org.apache.kafka.common.security.plain.PlainLoginModule required username=user password=pass;

B org.apache.kafka.common.security.plain.PlainLoginModule required username='user' password='pass';

C org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass";

D org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass"

💡 Hint

Look at how username and password values are quoted.

In JAAS config, username and password must be quoted strings. Option A lacks quotes, causing syntax error.

🚀 Application

expert

Determine the Number of SASL Mechanisms Supported

Given a Kafka broker configured with SASL mechanisms: PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, and GSSAPI, how many SASL mechanisms can a client choose from to authenticate?

A 2

B 3

C 5

D 4

💡 Hint

Count all listed mechanisms available for SASL authentication.

The broker supports four SASL mechanisms: PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, and GSSAPI, so clients can choose any of these four.

Practice

1. What is the main purpose of SASL authentication in Kafka?

easy

A. To compress messages for faster transmission

B. To verify user identity before allowing access

C. To balance load between Kafka brokers

D. To encrypt data stored on disk

Solution

1. Step 1: Understand SASL role in Kafka

   SASL is a protocol used to verify who is connecting to Kafka, ensuring only authorized users can access it.

2. Step 2: Differentiate from other Kafka features

   Compression, load balancing, and disk encryption are unrelated to SASL authentication.

3. Final Answer:

   To verify user identity before allowing access -> Option B

4. Quick Check:

   SASL = user verification [OK]

Hint: SASL is about user identity, not data or load [OK]

Common Mistakes:

• Confusing SASL with encryption
• Thinking SASL manages data compression
• Mixing SASL with load balancing

2. Which of the following is the correct way to specify SASL mechanism in Kafka client configuration?

easy

A. security.protocol = SASL_PLAINTEXT

B. sasl.config = PLAIN

C. sasl.mechanism = PLAIN

D. security.mechanism = SASL

Solution

1. Step 1: Identify correct property for SASL mechanism

   The Kafka client uses sasl.mechanism to specify the SASL mechanism like PLAIN, SCRAM, etc.

2. Step 2: Check other options for correctness

   security.protocol sets protocol type, not mechanism; sasl.config is invalid; security.mechanism is not a valid property.

3. Final Answer:

   sasl.mechanism = PLAIN -> Option C

4. Quick Check:

   sasl.mechanism sets SASL type [OK]

Hint: Use sasl.mechanism to set SASL type like PLAIN [OK]

Common Mistakes:

• Using security.protocol instead of sasl.mechanism
• Writing sasl.config instead of sasl.mechanism
• Confusing property names

3. Given this Kafka client configuration snippet:

props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "SCRAM-SHA-256");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user1\" password=\"pass1\";");

What will happen when the client tries to connect?

medium

A. Client connects using PLAINTEXT mechanism

B. Client connects but without encryption

C. Client fails due to missing SSL configuration

D. Client connects securely using SCRAM-SHA-256 with encrypted channel

Solution

1. Step 1: Analyze security.protocol setting

   Setting security.protocol to SASL_SSL means the client uses SASL authentication over SSL encrypted connection.

2. Step 2: Check SASL mechanism and JAAS config

   The mechanism is SCRAM-SHA-256 with proper JAAS config providing username and password, so authentication will succeed if credentials are correct.

3. Final Answer:

   Client connects securely using SCRAM-SHA-256 with encrypted channel -> Option D

4. Quick Check:

   SASL_SSL + SCRAM = secure auth [OK]

Hint: SASL_SSL means secure auth with encryption [OK]

Common Mistakes:

• Assuming SASL_SSL means no encryption
• Ignoring JAAS config for credentials
• Confusing SCRAM with PLAINTEXT

4. You have this Kafka client config:

props.put("security.protocol", "SASL_PLAINTEXT");
props.put("sasl.mechanism", "PLAIN");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"admin\" password=\"admin123\";");

The client fails to authenticate. What is the most likely cause?

medium

A. Broker does not support SASL_PLAINTEXT

B. Incorrect sasl.mechanism value

C. Wrong format in sasl.jaas.config string

D. Missing SSL configuration causes failure

Solution

1. Step 1: Check security.protocol compatibility

   SASL_PLAINTEXT means SASL without encryption. Many brokers disable this for security reasons.

2. Step 2: Consider broker support

   If the broker is configured to reject SASL_PLAINTEXT connections, authentication will fail even if credentials and mechanism are correct.

3. Final Answer:

   Broker does not support SASL_PLAINTEXT -> Option A

4. Quick Check:

   Broker must allow SASL_PLAINTEXT [OK]

Hint: Check if broker allows SASL_PLAINTEXT connections [OK]

Common Mistakes:

• Assuming SSL is required for SASL_PLAINTEXT
• Misformatting sasl.jaas.config string
• Using wrong sasl.mechanism value

5. You want to configure a Kafka client to use SASL_SSL with SCRAM-SHA-512 mechanism. Which of the following is the correct minimal configuration snippet in Java?

hard

A. props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "SCRAM-SHA-512");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";");

B. props.put("security.protocol", "SSL");
props.put("sasl.mechanism", "SCRAM-SHA-512");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";");

C. props.put("security.protocol", "SASL_PLAINTEXT");
props.put("sasl.mechanism", "SCRAM-SHA-256");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";");

D. props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "PLAIN");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"user\" password=\"pass\";");

Solution

1. Step 1: Match security.protocol with SASL_SSL

   To use encrypted SASL, security.protocol must be SASL_SSL.

2. Step 2: Confirm sasl.mechanism and JAAS config

   For SCRAM-SHA-512, sasl.mechanism must be SCRAM-SHA-512 and JAAS config must use ScramLoginModule with username and password.

3. Step 3: Eliminate incorrect options

   props.put("security.protocol", "SSL"); props.put("sasl.mechanism", "SCRAM-SHA-512"); props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";"); uses SSL without SASL, C uses wrong mechanism and protocol, D uses PLAIN mechanism instead of SCRAM-SHA-512.

4. Final Answer:

   Correct SASL_SSL with SCRAM-SHA-512 and proper JAAS config -> Option A

5. Quick Check:

   SASL_SSL + SCRAM-SHA-512 + JAAS = props.put("security.protocol", "SASL_SSL"); props.put("sasl.mechanism", "SCRAM-SHA-512"); props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";"); [OK]

Hint: Match protocol, mechanism, and JAAS module exactly [OK]

Common Mistakes:

• Using SSL instead of SASL_SSL
• Mismatching mechanism and JAAS module
• Using wrong SASL mechanism version