SASL Mechanisms

An order service needs an identity before it can publish to Kafka. The platform team could give it a password, let it use an existing Kerberos identity, or have it obtain an access token from the company's identity provider. Each approach can authenticate the service, but each creates different responsibilities for credentials, availability, and recovery.

Kafka supports these approaches through SASL mechanisms. Choosing one means deciding how applications prove their identity and which systems must keep working for that proof to succeed.

This chapter explains Kafka's supported mechanisms, their security properties, and the operational trade-offs behind the choice. Examples assume Apache Kafka 4.3 in KRaft mode and connections that use SASL_SSL for protection.