Plain

SASL/PLAIN is a straightforward authentication method that uses a username and password to authenticate to the Kafka brokers. It is widely supported and easy to configure, making it a common choice for securing Kafka connections. Since credentials are sent in plaintext, always pair SASL/PLAIN with TLS encryption.

Configuring the Connection

Define an inline guard holding the identity/credentials to authenticate with, then reference it from the kafka client binding's options.authorization, with mechanism set to plain and username/password templated from the guard's {identity}/{credentials}:

guards:
  guard0:
    type: inline
    options:
      identity: ${{env.SASL_USERNAME}}
      credentials: ${{env.SASL_PASSWORD}}
bindings:
  south_kafka_client:
    type: kafka
    kind: client
    options:
      servers:
        - ${{env.KAFKA_BOOTSTRAP_SERVER}}
      authorization:
        guard0:
          credentials:
            mechanism: plain
            username: "{identity}"
            password: "{credentials}"
    exit: south_tls_client
  south_tls_client:
    type: tls
    kind: client
    exit: south_tcp_client
  south_tcp_client:
    type: tcp
    kind: client

See the kafka client binding reference for the full set of options.authorization fields.