SASL

Introduction

What is SASL? SASL provides authentication mechanisms such as PLAIN, SCRAM, GSSAPI/Kerberos, and OAUTHBEARER.

Understanding the topic

What happens — SASL:

• Enable TLS for encrypted transport.
• Authenticate clients with SASL or mTLS.
• Authorize with ACLs per topic/group.
• Rotate secrets via vault or K8s.

Visual explanation

Pipeline view:

Client identity
  ↓
TLS/SASL authentication
  ↓
ACL authorization
  ↓
topic operation
  ↓
audit log

Step-by-step explanation

1. Encrypt — TLS on listeners.
2. Authenticate — SASL or certificates.
3. Authorize — kafka-acls grants.
4. Audit — Log access attempts.

Informative example

Example:

kafka-topics --bootstrap-server localhost:9092 --create --topic sasl --partitions 6 --replication-factor 3
kafka-console-producer --bootstrap-server localhost:9092 --topic sasl
kafka-console-consumer --bootstrap-server localhost:9092 --topic sasl --from-beginning
kafka-consumer-groups --bootstrap-server localhost:9092 --describe --group sasl-service

Execution workflow

Best practices

• Use least-privilege ACLs.
• Separate producer and consumer principals.
• Rotate credentials and avoid plaintext secrets.
• Audit access to sensitive topics.

Common mistakes

• Using wildcard ACLs in production.
• Committing JAAS configs or passwords.
• Assuming encryption solves authorization.

Summary

SASL — Apply least privilege per service, per topic, per operation; rotate secrets and audit access.