Enable and configure SASL authentication

Aiven for Apache Kafka® provides multiple authentication methods to secure your Apache Kafka® data, including the highly secure Simple Authentication and Security Layer (SASL).

Enable SASL authentication

Aiven Console

1. Access the Aiven Console and select your Aiven for Apache Kafka service.
2. Click Service settings.
3. Scroll to Advanced configuration and click Configure.
4. In the Advanced configuration window, set kafka_authentication_methods.sasl to Enabled.
5. Click Save configurations.

The Connection information in the Overview page now allows connections via SASL or Client certificate.

note

Although these connections use a different port, the host, CA, and user credentials remain consistent.

CLI

Enable SASL authentication for your Aiven for Apache Kafka service using Aiven CLI:

1. Get the name of the Aiven for Apache Kafka service:

   avn service list

   Note the SERVICE_NAME corresponding to your Aiven for Apache Kafka service.

2. Enable SASL authentication:

   avn service update SERVICE_NAME -c kafka_authentication_methods.sasl=true

   Parameters:

   • SERVICE_NAME: Name of your Aiven for Apache Kafka service.
   • kafka_authentication_methods.sasl: Set to true to enable SASL authentication.

API

Use the ServiceUpdate API to enable SASL authentication on an existing service:

 curl -X PUT "https://console.aiven.io/v1/project/{project_name}/service/{service_name}" \
   -H "Authorization: Bearer <API_TOKEN>" \
   -H "Content-Type: application/json" \
   -d '{
         "user_config": {
           "kafka_authentication_methods": {
             "sasl": true
           }
        }
     }'

Parameters:

• project_name: Name of your Aiven project.
• service_name: Name of your Aiven for Apache Kafka service.
• API_TOKEN: Personal Aiven token.
• kafka_authentication_methods.sasl: Set to true to enable SASL authentication.

Configure SASL mechanisms

After enabling SASL authentication, fine-tune the active SASL mechanisms for your Aiven for Apache Kafka service. By default, all mechanisms (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512) are enabled. Configure these settings only to disable any mechanisms.

Aiven Console

1. Access the Aiven Console and select your Aiven for Apache Kafka® service.

2. Click Service settings.

3. Scroll to Advanced configuration and click Configure.

4. In the Advanced configuration window, set the corresponding kafka_sasl_mechanisms value to either Enabled or Disabled:

   • PLAIN: kafka_sasl_mechanisms.plain
   • SCRAM-SHA-256: kafka_sasl_mechanisms.scram_sha_256
   • SCRAM-SHA-512: kafka_sasl_mechanisms.scram_sha_512

5. Click Save configurations.

CLI

Configure SASL mechanisms for your Aiven for Apache Kafka service using Aiven CLI:

1. Get the name of the Aiven for Apache Kafka service:

   avn service list

Note the SERVICE_NAME corresponding to your Aiven for Apache Kafka service.

1. Configure specific mechanisms:

   avn service update SERVICE_NAME             \
    -c kafka_sasl_mechanisms.plain=true          \
    -c kafka_sasl_mechanisms.scram_sha_256=true  \
    -c kafka_sasl_mechanisms.scram_sha_512=true

   Parameters:

   • SERVICE_NAME: Name of your Aiven for Apache Kafka service.
   • kafka_sasl_mechanisms.plain: Set to true to enable the PLAIN mechanism.
   • kafka_sasl_mechanisms.scram_sha_256: Set to true to enable the SCRAM-SHA-256 mechanism.
   • kafka_sasl_mechanisms.scram_sha_512: Set to true to enable the SCRAM-SHA-512 mechanism.

API

Use the ServiceUpdate API to enable SASL authentication on an existing service:

curl -X PUT "https://console.aiven.io/v1/project/{project_name}/service/{service_name}" \
     -H "Authorization: Bearer <API_TOKEN>" \
     -H "Content-Type: application/json" \
     -d '{
           "user_config": {
             "kafka_authentication_methods": {
               "sasl": true
             }
           }
         }'

Parameters:

• project_name: Name of your Aiven project.
• service_name: Name of your Aiven for Apache Kafka service.
• API_TOKEN: API token for authentication.
• kafka_sasl_mechanisms.plain: Set to true or false to enable or disable the PLAIN mechanism.
• kafka_sasl_mechanisms.scram_sha_256: Set to true or false to enable or disable the SCRAM-SHA-256 mechanism.
• kafka_sasl_mechanisms.scram_sha_512: Set to true or false to enable or disable the SCRAM-SHA-512 mechanism.

note

• At least one SASL mechanism must remain enabled. Disabling all results in an error.
• OAUTHBEARER is enabled if sasl_oauthbearer_jwks_endpoint_url is specified.

Related pages

• Enable OAUTH2/OIDC authentication for Aiven for Apache Kafka
• Authentication types