0

I am trying to find out if it is to utilize the client certificate (mTLS) between Kafka clients and brokers as well as using SASL. My goal is to ignore SASL credentials when client certificate is present and in other cases use SASL if client certificate is not present. I can see that https://cwiki.apache.org/confluence/display/KAFKA/KIP-684+-+Support+mutual+TLS+authentication+on+SASL_SSL+listeners allows for combinations of the two, but as I understand it, it mentions that SASL is always used even if client certificate is present.

Thank you.

Tomas
  • 45
  • 6

1 Answers1

0

First, KIP-684 is only implemented since 2.8.0, and AFAIK SASL user takes precedence over mTLS. And you can not make SASL authentication optional once you have enabled it on a listener.

As a result, I would advise you to have 2 listeners, on 2 different TCP ports. Let's say:

  • Port 9092 for SASL_SSL, SASL with simple TLS -> for applications authenticating with SASL
  • Port 9093 for mTLS, 2-way TLS without SASL -> for applications authenticating with client TLS cert.
G Quintana
  • 4,556
  • 1
  • 22
  • 23