Overview
Security is optional in Kafka. For authentication it supports SSL client certificates and SASL, with the mechanisms GSSAPI (Kerberos), PLAIN, SCRAM-SHA-256, SCRAM-SHA-512 and OAUTHBEARER. TLS encrypts traffic in transit. The SASL documentation says PLAIN should be used only with TLS as the transport, that SCRAM should be used only with TLS and is suitable for production where the KRaft controllers are secure and on a private network, and that the default OAUTHBEARER implementation is only suitable for non-production installations. Authorization is pluggable (authorizer.class.name); the default implementation stores ACLs in the KRaft metadata log, kafka-acls.sh manages them, and external authorization services can be integrated. ACLs can match topics by prefix.
Key configuration
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-256
sasl.jaas.config=<login module configuration for the mechanism>
ssl.truststore.location=/certs/kafka.truststore.jks
ssl.truststore.password=<password> # technically optional, highly recommended
# ssl.keystore.location is optional for a client and only needed for two-way (mutual) TLSProduction tip
Check yourself
What does the SASL documentation say about the PLAIN mechanism?
Sources
- Security overview (4.2 documentation) (opens in a new tab)
- Authentication using SASL (4.2 documentation) (opens in a new tab)
- Encryption and authentication using SSL (4.2 documentation) (opens in a new tab)
- Authorization and ACLs (4.2 documentation) (opens in a new tab)
- Broker configs (4.2 documentation) (opens in a new tab)
- Design (4.2 documentation) (opens in a new tab)
Checked against Kafka 4.2 documentation on Oct 2026. Draft: not yet reviewed by a Kafka specialist. Releases move on, so confirm against the current documentation before you act on a number.