Configure Kafka LDAP authentication for Kafka clients

Learn how to configure Kafka clients for LDAP authentication.

You can enable Kafka to use LDAP credentials for client to broker authentication. Client configuration is done by adding the required properties to the client's client.properties file.

Clients connecting to Data Hub provisioned clusters require a CDP user account that provides access to the required CDP resources. Verify that a CDP user account with the required roles and permissions is available for use. If not, create one. Any type of CDP user account can be used. If you are creating a new account to be used by Kafka clients, Cloudera recommends that you create a machine user account. For more information, see User Management in the Cloudera Management Console documentation.
In addition to the CDP user account having access to the required CDP resources, the user account also needs to have the correct policies assigned to it in Ranger. Otherwise, the client cannot perform tasks on Kafka resources. These policies are specified within the Ranger instance that provides authorization to the Kafka service you want to connect to. For more information, see the Cloudera Runtime documentation on Apache Ranger and the Kafka specific Ranger documentation.
If you are transitioning from PAM to LDAP, ensure that the usernames you specify in the client configuration are short names. Usernames that include the realm/domain are not supported.

Set the SASL mechanism to PLAIN.
Add the following property to the client.properties file.
```
sasl.mechanism=PLAIN
```
Configure the security protocol.
You can either use SASL_SSL or SASL_PLAINTEXT. Which security protocol you use will depend on whether or not SSL encryption is enabled on the broker. Add one of the following properties to the client.properties file.
- If encryption is enabled, use SASL_SSL:
```
security.protocol=SASL_SSL
```
- If encryption is not enabled, use SASL_PLAINTEXT:
```
security.protocol=SASL_PLAINTEXT
```
note
In a public network Cloudera recommends that you use SASL_SSL as LDAP credentials can become exposed.
Configure the JAAS.
You have two options when configuring the JAAS:
1. Embed the required properties in the client.properties file with the sasl.jaas.config property.
```
sasl.jaas.config= \ 
org.apache.kafka.common.security.plain.PlainLoginModule required \
    username="[***USERNAME***]" \
    password="[***PASSWORD***]";
```
  Replace [***USERNAME***] and [***PASSWORD***] with the credentials of the CDP user you set up for the client in Management Console. For the username, ensure that you use short names. Specifying usernames that contain the realm/domain are not supported.
2. Use a separate JAAS config file:
  1. Add a KafkaClient entry with a login module item to your JAAS configuration file.
    Example configuration:
    KafkaClient { org.apache.kafka.common.security.plain.PlainLoginModule required username="[***USERNAME***]" password="[***PASSWORD***]"; };
    Replace [***USERNAME***] and [***PASSWORD***] with the credentials of the CDP user you set up for the client in Management Console. For the username, ensure that you use short names. Specifying usernames that contain the realm/domain are not supported.
  2. Pass the location of your JAAS configuration file as a JVM parameter through a command line interface
```
export KAFKA_OPTS="-Djava.security.auth.login.config=[***PATH TO JAAS.CONF***]"
```
    Replace [***PATH TO JAAS.CONF***] with the location of the JAAS configuration file you created.

LDAP authentication is configured for the client.