SCRAM

SASL/SCRAM (Salted Challenge Response Authentication Mechanism) is a more secure alternative to SASL/PLAIN. It avoids transmitting plaintext passwords by using a challenge-response exchange and incorporates salting to protect against replay attacks. SCRAM is a good fit for environments that need stronger security without relying on an external system like Kerberos.

Configuring the Connection

Define an inline guard holding the identity/credentials to authenticate with, then reference it from the kafka client binding's options.authorization, with mechanism set to scram-sha-256 and username/password templated from the guard's {identity}/{credentials}:

guards:
  guard0:
    type: inline
    options:
      identity: ${{env.SASL_USERNAME}}
      credentials: ${{env.SASL_PASSWORD}}
bindings:
  south_kafka_client:
    type: kafka
    kind: client
    options:
      servers:
        - ${{env.KAFKA_BOOTSTRAP_SERVER}}
      authorization:
        guard0:
          credentials:
            mechanism: scram-sha-256
            username: "{identity}"
            password: "{credentials}"
    exit: south_tls_client
  south_tls_client:
    type: tls
    kind: client
    exit: south_tcp_client
  south_tcp_client:
    type: tcp
    kind: client

scram-sha-1 and scram-sha-512 are also supported; see the kafka client binding reference for the full set of options.authorization fields.