Cloudera Docs

Configure LDAP authentication for Kafka brokers

Learn how to configure LDAP authentication for Kafka brokers.

You can enable Kafka to use LDAP credentials for client to broker authentication. Broker configuration is done by configuring the required properties in Cloudera Manager.

  1. In Cloudera Manager, select the Kafka service.
  2. Select Configuration.
  3. Enable LDAP authentication:
    1. Find the SASL/PLAIN Authentication property.
    2. Click the radio button next to LDAP. Do this for all required Kafka services.
  4. Optional: Configure the allow list of LDAP URLs.
    You can restrict which LDAP URLs Kafka is allowed to connect to by configuring the com.cloudera.kafka.ldap.allowed.urls Java option. By specifying a trusted list of LDAP servers, you can have stricter control over the LDAP servers Kafka can access.
    1. Find the Additional Broker Java Options property.
    2. Add the com.cloudera.kafka.ldap.allowed.urls Java option. For example: 
      -Dcom.cloudera.kafka.ldap.allowed.urls=http://www.ldap-example-1.com,http://www.ldap-example-2.com
  5. Click Save Changes.
  6. Restart the Kafka service.
LDAP authentication is configured for the brokers.
Configure clients to use LDAP authentication.