Security — SASL/SCRAM authentication & ACL authorization

Authentication establishes the identity of the principal (TLS mutual auth or a SASL mechanism). Authorization is a separate layer. The authorizer checks the requests of that principal against ACLs. You need both to lock down a cluster.

Source: https://kafka.apache.org/documentation/#security_authz

The authorizer denies anything without a matching allow ACL (unless the principal is a super user). An unauthorized produce fails with TOPIC_AUTHORIZATION_FAILED. This is the denial that you test for.

Source: https://kafka.apache.org/documentation/#security_authz

Kafka stores SCRAM credentials in the cluster metadata, and you create them with kafka-configs.sh. SCRAM is a salted challenge-response mechanism, so the raw password is never transmitted.

Source: https://kafka.apache.org/documentation/#security_sasl_scram_credentials

super.users bypass authorization entirely. If you give this to an application, you do the opposite of least privilege. Use it only for a trusted internal/admin path. Give apps narrow ACLs.

Source: https://kafka.apache.org/documentation/#security_authz

Consuming needs two grants: Read on the Topic and Read on the consumer Group resource. If you grant only the topic, the authorizer accepts the fetch, but the group join and commit fail.

Source: https://kafka.apache.org/documentation/#security_authz_cli

The client must select the SASL security protocol and mechanism. It must also give its SCRAM username and password. These identify the principal that the broker authorizes.

Source: https://kafka.apache.org/documentation/#security_sasl_scram

A producer needs Write (and Describe) on exactly that topic. All of these violate least privilege: granting All, a wildcard topic, Read/Delete, or super-user status.

Source: https://kafka.apache.org/documentation/#security_authz_cli

SASL_PLAINTEXT gives authentication without TLS encryption. It is fine on a trusted local loopback for teaching. Production must use SASL_SSL, so the channel is encrypted.

Source: https://kafka.apache.org/documentation/#security_sasl_scram