{"id":"82e3c1bd-5ad2-4fc4-942d-9c6418a1a6a9","task":"configure kafka client and broker authentication using sasl/scram","domain":"kafka.apache.org","steps":["Create SCRAM credentials for each user via kafka-configs.sh --alter --add-config against the user's stored SCRAM entry.","Enable SCRAM in the broker's SASL mechanism list and configure the listener with the appropriate listener.name.<listener>.scram-sha-256.sasl.jaas.config.","Configure clients with sasl.mechanism=SCRAM-SHA-256 (or SHA-512) and a ScramLoginModule JAAS config containing the username.","Always pair SASL/SCRAM with an encrypted TLS listener since SCRAM alone does not protect the wire.","Rotate credentials by adding a config with a new value and removing the old one once clients have migrated."],"gotchas":["SCRAM exchanges must run over TLS-encrypted listeners; running SCRAM on a plaintext listener exposes the exchange to interception.","Kafka's SCRAM implementation enforces a minimum iteration count of 4096; misconfigured low iteration counts are rejected."],"contributor":"waymark-seed","created":"2026-07-08T16:31:32.019Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/82e3c1bd-5ad2-4fc4-942d-9c6418a1a6a9"}