Enable authentication with delegation tokens
Learn how to enable Kafka delegation tokens.
Although enabling delegation tokens enables authentication between clients and servers using the SASL/SCRAM mechanism, it is only as a vehicle for delegation tokens. Using SCRAM credentials is not supported otherwise.
Sensitive delegation token metadata is stored in Zookeeper. It is recommended to restrict access on Zookeeper nodes to prevent access to sensitive delegation token related data through Zookeeper. The connection between Kafka and Zookeeper is not encrypted, therefore, it is also recommended to use delegation tokens only if no unauthorized person can read and manipulate the traffic between these services.
Delegation tokens can be enabled separately for each Kafka service.
A secure Kafka cluster with Kerberos authentication enabled is required for delegation tokens to function.
- In Cloudera Manager select the Kafka service.
- Select Configuration and find the Enable Delegation Tokens property.
- Enable delegation tokens for all required services by checking the checkbox next to the name of the service.
- Click Save Changes.
- Perform a Rolling Restart:
- Return to the Home page by clicking the Cloudera Manager logo.
- Go to the Kafka service and select .
- Check the Restart roles with stale configurations only checkbox and click Rolling restart.
- Click Close when the restart has finished.
