Specifies the authentication scheme that the provider uses when connecting to the Apache Kafka broker.

Possible Values

None, Plain, SCRAM, SCRAM-SHA-512, Kerberos, SSLCertificate, KafkaOAuthClient, AzureAD, AzureMSI, AzureServicePrincipal, AzureServicePrincipalCert, OAuthJWT, GCPInstanceAccount, AWSWorkloadIdentity, AzureWorkloadIdentity, AWSMSKIAM

Data Type

string

Default Value

"None"

Remarks

Authentication requirements vary by Kafka deployment. The provider supports several authentication schemes used by self-managed Kafka clusters, cloud-managed Kafka services, and Schema Registry environments. The schemes listed below determine how the provider obtains credentials and establishes a secure connection to the broker.

Supported schemes for Apache Kafka:

Scheme	Description
None	Connects without authentication. No credentials are required.
Plain	Authenticates using a plain text login module. Requires User and Password.
SCRAM	Authenticates using a SCRAM login module with SHA-256 hashing.
SCRAM-SHA-512	Authenticates using a SCRAM login module with SHA-512 hashing.
Kerberos	Use Kerberos authentication. Requires a Kerberos configuration file and relevant Kerberos properties.
SSLCertificate	Authenticates using an SSL client certificate.
KafkaOAuthClient	Authenticates using Kafka's native OpenID Connect (KIP-768) authentication with the client credentials grant type. Note: This does not use the provider's built-in support for OAuth like the Azure and OAuthJWT authentication methods do. Only the OAuthClientId, OAuthClientSecret, OAuthAccessTokenURL, and Scope properties have any effect on the behavior of this scheme. Use ConsumerProperties and ProducerProperties to provide advanced configuration.
AzureAD	Authenticates using Azure Active Directory OAuth.
AzureMSI	Obtains Managed Service Identity credentials automatically when running on an Azure VM.
AzureServicePrincipal	Authenticates as an Azure Service Principal using a client secret.
AzureServicePrincipalCert	Authenticates as an Azure Service Principal using a certificate.
OAuthJWT	Authenticates using an OAuth service account with JWT-based credential flow.
GCPInstanceAccount	Authenticates using an access token obtained from a Google Cloud instance.
AWSWorkloadIdentity	Authenticates using AWS Workload Identity Federation.
AWSMSKIAM	Authenticates to Amazon MSK (Managed Streaming for Apache Kafka) using AWS IAM credentials. Generates a presigned SigV4 OAUTHBEARER token compatible with the aws-msk-iam-auth library. The provider auto-detects the credential source: set AWSAccessKey and AWSSecretKey to sign the token with static keys; set AWSRoleARN to assume an IAM role via AWS STS before connecting; or leave the keys empty to sign with the credentials of the EC2 instance IAM role attached to the host machine. AWSAccessKey and AWSSecretKey are optional: when the host has an attached EC2 instance IAM role, setting only AWSRoleARN (or neither keys nor role) is sufficient, and the provider obtains base credentials from the instance profile automatically. When static keys are supplied together with AWSRoleARN, they serve as the base credentials for the STS AssumeRole call. Set AWSRegion if it cannot be inferred from the broker hostname.

Schemes for authenticating to Azure Event Hubs:

AzureAD	Authenticates using Azure Active Directory OAuth.
AzureMSI	Obtains Managed Service Identity credentials automatically when running on an Azure VM.
AzureServicePrincipal	Authenticates as an Azure Service Principal using a client secret.
AzureServicePrincipalCert	Authenticates as an Azure Service Principal using a certificate.

Schemes for authenticating to GMS Kafka:

OAuthJWT	Authenticates using an OAuth service account.
GCPInstanceAccount	Authenticates using a Google Cloud instance account.
AWSWorkloadIdentity	Authenticates using AWS Workload Identity Federation. GMS Kafka does not allow external principals to authenticate directly, so you must delegate authentication to a service account using the RequestingServiceAccount property.