<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>question Kafka: security.inter.broker.protocol can not be set to SASL_SSL, as Kerberos is not enabled in Support Questions</title>
    <link>https://community.cloudera.com/t5/Support-Questions/Kafka-security-inter-broker-protocol-can-not-be-set-to-SASL/m-p/79267#M45308</link>
    <description>&lt;P&gt;Hi guys,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have a Kafka cluster and want to enable SASL_SSL without Kerberos.&lt;/P&gt;&lt;P&gt;Is it possible?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;What I changed in kafka.properties:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;PRE&gt;listeners=PLAINTEXT://kafkatest03.loc:9092, SSL://kafkatest03.loc:9093, SASL_SSL://kafkatest03.loc:9094, SASL_PLAINTEXT://kafkatest03.loc:9095
advertised.listeners=PLAINTEXT://kafkatest03.loc:9092, SSL://kafkatest03.loc:9093, SASL_SSL://kafkatest03.loc:9094, SASL_PLAINTEXT://kafkatest03.loc:9095
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
sasl.enabled.mechanisms=SCRAM-SHA-256
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer&lt;BR /&gt;&lt;BR /&gt;ssl.keystore.location=...&lt;BR /&gt;ssl.keystore.password.generator=...&lt;BR /&gt;ssl.key.password.generator=...&lt;BR /&gt;ssl.truststore.location=...&lt;BR /&gt;ssl.truststore.password.generator=...

&lt;/PRE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Added to broker_java_opts:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;PRE&gt;-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf

KafkaServer {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="admin"
    password="admin";
};&lt;/PRE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;When I set security.inter.broker.protocol to PLAINTEXT everything is working and client can auth wirh SASL_SSL using&amp;nbsp;SCRAM-SHA-256, but ACL is not working.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;According to this:&lt;/P&gt;&lt;P&gt;&lt;A href="https://github.com/wurstmeister/kafka-docker/issues/218" target="_blank"&gt;https://github.com/wurstmeister/kafka-docker/issues/218&lt;/A&gt;&lt;/P&gt;&lt;P&gt;we need to enable&lt;/P&gt;&lt;P&gt;security.inter.broker.protocol=SASL_SSL, but it throws an error:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;PRE&gt;security.inter.broker.protocol can not be set to SASL_SSL, as Kerberos is not enabled&lt;/PRE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks&lt;/P&gt;</description>
    <pubDate>Fri, 16 Sep 2022 13:39:29 GMT</pubDate>
    <dc:creator>Denys</dc:creator>
    <dc:date>2022-09-16T13:39:29Z</dc:date>
  </channel>
</rss>

