Kafka Security: SSL & SASL
AdvancedKafka supports SSL/TLS for encryption-in-transit and SASL mechanisms (PLAIN, SCRAM, GSSAPI/Kerberos, OAUTHBEARER) for authentication. ACLs control which principals can produce/consume from which topics.
Overview
A production Kafka cluster must protect data in transit (SSL), authenticate clients (SASL), and authorise actions (ACLs). In cloud environments, OAUTHBEARER with an IdP is increasingly standard.
TLS + SASL/SCRAM in Spring Boot
SASL/SCRAM-SHA-256 is the recommended mechanism for username/password auth. ACLs control what each principal can do.
# Broker — server.properties
listeners=SASL_SSL://0.0.0.0:9093
security.inter.broker.protocol=SASL_SSL
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256
sasl.enabled.mechanisms=SCRAM-SHA-256
ssl.keystore.location=/certs/kafka.keystore.jks
ssl.keystore.password=changeit
ssl.truststore.location=/certs/kafka.truststore.jks
ssl.truststore.password=changeit
# Spring Boot client — application.properties
spring.kafka.security.protocol=SASL_SSL
spring.kafka.properties.sasl.mechanism=SCRAM-SHA-256
spring.kafka.properties.sasl.jaas.config=\
org.apache.kafka.common.security.scram.ScramLoginModule required \
username="app-user" password="secret";
# Create ACL — allow app-user to produce to orders
kafka-acls.sh --bootstrap-server kafka:9093 \
--add --allow-principal User:app-user \
--producer --topic ordersKey Points to Remember
- 1SSL/TLS encrypts data in transit; mTLS also authenticates clients
- 2SASL/SCRAM-SHA-256 is the most common username/password mechanism
- 3GSSAPI/Kerberos is standard in enterprise/Hadoop environments
- 4Kafka ACLs use Allow/Deny rules per principal, topic, and operation
- 5Super users bypass ACLs — protect super.users carefully
Interview Questions
Sign in to ask AriaWhat is the difference between SSL and SASL in Kafka security?
How does mTLS differ from one-way TLS in Kafka?
What is a Kafka ACL and how do you grant a consumer read access to a topic?
Which SASL mechanism would you use for a cloud-native Kafka deployment?
What are the security implications of not setting up ACLs on a Kafka cluster?
Ask Aria about Kafka Security: SSL & SASL
Your personal AI tutor — ask anything about this concept
Revision Status
Personal Notes
Sign in to save personal notes for this topic.
Discussion
Sign in to join the discussion.