SASL authentication in Kafka - Step-by-Step Execution

Process Flow - SASL authentication

Client starts connection

↓

Client sends SASL handshake request

↓

Server responds with supported SASL mechanisms

↓

Client selects SASL mechanism and sends authentication data

↓

Server verifies authentication data

↓

If authentication succeeds

→Connection established

↓

If authentication fails

→Connection closed

This flow shows how a Kafka client and server use SASL to securely authenticate before establishing a connection.

Execution Sample

Kafka

props.put("security.protocol", "SASL_PLAINTEXT");
props.put("sasl.mechanism", "PLAIN");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"user\" password=\"pass\";");

This code configures a Kafka client to use SASL PLAIN authentication with username and password.

Process Table

Step	Action	Client Message	Server Response	Result
1	Client starts connection	Connect request	Await SASL handshake	Connection initiated
2	Client sends SASL handshake request	SASL handshake request	SASL mechanisms list: PLAIN, SCRAM-SHA-256	Client learns mechanisms
3	Client selects mechanism and sends auth data	SASL auth data (username/password)	Verify credentials	Server checks credentials
4	Server verifies authentication	N/A	Authentication success	Connection established
5	If credentials wrong	SASL auth data	Authentication failure	Connection closed

💡 Execution stops when authentication succeeds or fails, ending connection setup.

Status Tracker

Variable	Start	After Step 2	After Step 3	Final
connection_state	Disconnected	Handshake sent	Auth data sent	Authenticated or Closed
sasl_mechanism	None	Received list	Selected PLAIN	Used for auth
auth_status	None	None	Pending	Success or Failure

Key Moments - 2 Insights

Why does the client send a SASL handshake request before authentication data?

The handshake lets the client know which SASL mechanisms the server supports (see execution_table step 2). Without this, the client wouldn't know how to authenticate.

What happens if the server rejects the authentication data?

The server sends an authentication failure response and closes the connection (see execution_table step 5). The client cannot proceed without valid credentials.

Visual Quiz - 3 Questions

Look at the execution_table at step 3, what does the client send?

A SASL auth data (username/password)

B Connection close request

C SASL handshake request

D List of supported mechanisms

💡 Hint

Check the 'Client Message' column at step 3 in the execution_table.

At which step does the server verify the client's credentials?

A Step 2

B Step 4

C Step 3

D Step 1

💡 Hint

Look at the 'Server Response' and 'Result' columns in the execution_table for step 4.

If the client changes the SASL mechanism to SCRAM-SHA-256, which execution_table step would change?

A Step 2 - Server lists mechanisms

B Step 4 - Server verifies authentication

C Step 3 - Client selects mechanism and sends auth data

D Step 5 - Authentication failure

💡 Hint

Changing the mechanism affects what the client sends in step 3.

Concept Snapshot

SASL authentication in Kafka:
- Client starts connection
- Client sends SASL handshake request
- Server replies with supported mechanisms
- Client selects mechanism and sends credentials
- Server verifies and accepts or rejects
Use properties: security.protocol, sasl.mechanism, sasl.jaas.config

Full Transcript

SASL authentication in Kafka starts when the client initiates a connection. The client sends a SASL handshake request to learn which authentication methods the server supports. The server responds with a list of mechanisms like PLAIN or SCRAM-SHA-256. The client then picks one mechanism and sends the authentication data, such as username and password. The server checks these credentials. If they are correct, the connection is established. If not, the server closes the connection. This process ensures secure authentication before any data is exchanged.

Practice

1. What is the main purpose of SASL authentication in Kafka?

easy

A. To compress messages for faster transmission

B. To verify user identity before allowing access

C. To balance load between Kafka brokers

D. To encrypt data stored on disk

Solution

1. Step 1: Understand SASL role in Kafka

   SASL is a protocol used to verify who is connecting to Kafka, ensuring only authorized users can access it.

2. Step 2: Differentiate from other Kafka features

   Compression, load balancing, and disk encryption are unrelated to SASL authentication.

3. Final Answer:

   To verify user identity before allowing access -> Option B

4. Quick Check:

   SASL = user verification [OK]

Hint: SASL is about user identity, not data or load [OK]

Common Mistakes:

• Confusing SASL with encryption
• Thinking SASL manages data compression
• Mixing SASL with load balancing

2. Which of the following is the correct way to specify SASL mechanism in Kafka client configuration?

easy

A. security.protocol = SASL_PLAINTEXT

B. sasl.config = PLAIN

C. sasl.mechanism = PLAIN

D. security.mechanism = SASL

Solution

1. Step 1: Identify correct property for SASL mechanism

   The Kafka client uses sasl.mechanism to specify the SASL mechanism like PLAIN, SCRAM, etc.

2. Step 2: Check other options for correctness

   security.protocol sets protocol type, not mechanism; sasl.config is invalid; security.mechanism is not a valid property.

3. Final Answer:

   sasl.mechanism = PLAIN -> Option C

4. Quick Check:

   sasl.mechanism sets SASL type [OK]

Hint: Use sasl.mechanism to set SASL type like PLAIN [OK]

Common Mistakes:

• Using security.protocol instead of sasl.mechanism
• Writing sasl.config instead of sasl.mechanism
• Confusing property names

3. Given this Kafka client configuration snippet:

props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "SCRAM-SHA-256");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user1\" password=\"pass1\";");

What will happen when the client tries to connect?

medium

A. Client connects using PLAINTEXT mechanism

B. Client connects but without encryption

C. Client fails due to missing SSL configuration

D. Client connects securely using SCRAM-SHA-256 with encrypted channel

Solution

1. Step 1: Analyze security.protocol setting

   Setting security.protocol to SASL_SSL means the client uses SASL authentication over SSL encrypted connection.

2. Step 2: Check SASL mechanism and JAAS config

   The mechanism is SCRAM-SHA-256 with proper JAAS config providing username and password, so authentication will succeed if credentials are correct.

3. Final Answer:

   Client connects securely using SCRAM-SHA-256 with encrypted channel -> Option D

4. Quick Check:

   SASL_SSL + SCRAM = secure auth [OK]

Hint: SASL_SSL means secure auth with encryption [OK]

Common Mistakes:

• Assuming SASL_SSL means no encryption
• Ignoring JAAS config for credentials
• Confusing SCRAM with PLAINTEXT

4. You have this Kafka client config:

props.put("security.protocol", "SASL_PLAINTEXT");
props.put("sasl.mechanism", "PLAIN");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"admin\" password=\"admin123\";");

The client fails to authenticate. What is the most likely cause?

medium

A. Broker does not support SASL_PLAINTEXT

B. Incorrect sasl.mechanism value

C. Wrong format in sasl.jaas.config string

D. Missing SSL configuration causes failure

Solution

1. Step 1: Check security.protocol compatibility

   SASL_PLAINTEXT means SASL without encryption. Many brokers disable this for security reasons.

2. Step 2: Consider broker support

   If the broker is configured to reject SASL_PLAINTEXT connections, authentication will fail even if credentials and mechanism are correct.

3. Final Answer:

   Broker does not support SASL_PLAINTEXT -> Option A

4. Quick Check:

   Broker must allow SASL_PLAINTEXT [OK]

Hint: Check if broker allows SASL_PLAINTEXT connections [OK]

Common Mistakes:

• Assuming SSL is required for SASL_PLAINTEXT
• Misformatting sasl.jaas.config string
• Using wrong sasl.mechanism value

5. You want to configure a Kafka client to use SASL_SSL with SCRAM-SHA-512 mechanism. Which of the following is the correct minimal configuration snippet in Java?

hard

A. props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "SCRAM-SHA-512");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";");

B. props.put("security.protocol", "SSL");
props.put("sasl.mechanism", "SCRAM-SHA-512");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";");

C. props.put("security.protocol", "SASL_PLAINTEXT");
props.put("sasl.mechanism", "SCRAM-SHA-256");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";");

D. props.put("security.protocol", "SASL_SSL");
props.put("sasl.mechanism", "PLAIN");
props.put("sasl.jaas.config", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"user\" password=\"pass\";");

Solution

1. Step 1: Match security.protocol with SASL_SSL

   To use encrypted SASL, security.protocol must be SASL_SSL.

2. Step 2: Confirm sasl.mechanism and JAAS config

   For SCRAM-SHA-512, sasl.mechanism must be SCRAM-SHA-512 and JAAS config must use ScramLoginModule with username and password.

3. Step 3: Eliminate incorrect options

   props.put("security.protocol", "SSL"); props.put("sasl.mechanism", "SCRAM-SHA-512"); props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";"); uses SSL without SASL, C uses wrong mechanism and protocol, D uses PLAIN mechanism instead of SCRAM-SHA-512.

4. Final Answer:

   Correct SASL_SSL with SCRAM-SHA-512 and proper JAAS config -> Option A

5. Quick Check:

   SASL_SSL + SCRAM-SHA-512 + JAAS = props.put("security.protocol", "SASL_SSL"); props.put("sasl.mechanism", "SCRAM-SHA-512"); props.put("sasl.jaas.config", "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"user\" password=\"pass\";"); [OK]

Hint: Match protocol, mechanism, and JAAS module exactly [OK]

Common Mistakes:

• Using SSL instead of SASL_SSL
• Mismatching mechanism and JAAS module
• Using wrong SASL mechanism version