kafka 3.9 config/kraft/kafka_server_jaas.conf

### Kafka 3.9 KRaft Mode `kafka_server_jaas.conf` Configuration Details In the context of Apache Kafka version 3.9 operating under KRaft (Kafka Raft Metadata) mode, configuring security through JAAS is essential for enabling SASL authentication mechanisms. The file `/etc/kafka/kafka_server_jaas.conf` plays a critical role in specifying how clients authenticate to brokers and vice versa. For setting up this configuration specifically within KRaft mode: #### Broker-to-Broker Authentication Entry The following entry configures broker-to-broker communication using SCRAM-SHA-512 as an example mechanism: ```plaintext KafkaServer { org.apache.kafka.common.security.scram.ScramLoginModule required username="broker" password="broker-secret"; }; ``` This ensures that all internal communications between brokers are authenticated securely[^1]. #### Client-to-Broker Authentication Entry To allow client applications to connect securely via SASL/SCRAM, add another section like so: ```plaintext Client { org.apache.kafka.common.security.scram.ScramLoginModule required username="client-user" password="client-password"; }; ``` Here, replace `"client-user"` and `"client-password"` with credentials intended for application-level access control purposes[^2]. It's important to note when running Kafka in KRaft mode, these configurations must align closely not only with your overall cluster setup but also any additional layers of network or transport layer security you might have enabled such as TLS encryption on top of SASL-based mutual authentication schemes. When starting Kafka servers configured thusly, ensure `-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf` appears correctly appended to startup scripts ensuring proper loading at runtime initialization stages.