> This page is for Docs.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Configure Kafka authentication

> Configure how Zuora authenticates with your Kafka cluster using SASL (SCRAM or PLAIN) or TLS/SSL, and review how credentials and certificates are handled securely.

Configure how Zuora authenticates with your Kafka cluster using SASL (SCRAM or PLAIN) or TLS/SSL, and review how credentials and certificates are handled securely.

To configure SASL with SCRAM authentication:

1. Select **SASL_SSL** or **SASL_PLAINTEXT** as the **Security Protocol**.
2. Select **SCRAM** as the **SASL Mechanism**.
3. In the **SCRAM Authentication** section, select a **Mechanism Variant**.

   SCRAM‑SHA‑256
4. Enter the Kafka **Username** and **Password**.
5. Review the auto‑generated JAAS configuration, which uses `ScramLoginModule` and your credentials.

Username and password values are treated as secrets and, after you save the connection, are not shown again in the UI or returned by the API. Connections are rejected if SCRAM settings are incomplete or invalid, for example:

* Missing SASL mechanism or JAAS configuration.
* Empty username or password in the JAAS configuration.
* A JAAS login module that does not match the selected SCRAM mechanism.

For API requests, `sasl.jaas.config` must use:

* `org.apache.kafka.common.security.scram.ScramLoginModule` for SCRAM-SHA-256 or SCRAM-SHA-512.
* `org.apache.kafka.common.security.plain.PlainLoginModule` for PLAIN.

To configure SASL with PLAIN authentication:

1. Select **SASL_SSL** or **SASL_PLAINTEXT** as the **Security Protocol**.
2. Select **PLAIN** as the **SASL Mechanism**.
3. In the **PLAIN Authentication** section, enter the Kafka **Username** and **Password**.

   The wizard shows the auto‑generated JAAS configuration using `PlainLoginModule`.

As with SCRAM, PLAIN credentials are stored securely as secrets and are not returned in API responses.

To configure TLS / SSL authentication:

1. Select **SSL** or **SASL_SSL** as the **Security Protocol**.
2. In the **TLS / SSL Configuration** section, under **Truststore Type**, choose **JKS** or **PKCS12**.

   **Truststore Type** identifies the format of the certificate store used for TLS. Select the option that matches your truststore file (Java Key Store for JKS, or PKCS #12 for PKCS12).
3. Upload the **Truststore Location** file and enter the **Truststore Password**.

   **Truststore Location** specifies the JKS file that contains the CA or server certificates your Kafka client will trust; upload the exact truststore used by your cluster's TLS configuration. **Truststore Password** is the password that protects this JKS file and must match the password configured on the truststore so Zuora can open it during TLS handshakes.
4. (Optional) Select **Show additional options** to configure the **SSL Endpoint Identification Algorithm** (`https` to enable hostname verification).

   This setting controls hostname verification for TLS. Set it to `https` so Kafka verifies that the broker certificate's host name matches the bootstrap server you configured, helping prevent misconfiguration and man-in-the-middle issues. Only `https` is accepted; disabling hostname verification by setting this field to an empty string or any other value is not supported.
5. Upload a **Keystore Location** file and provide the **Keystore Password** and **Key Password** for mutual TLS.

   **Keystore Location** specifies the JKS/PKCS12 file that contains the client certificate and private key used for mutual TLS when your brokers require client authentication. **Keystore Password** unlocks the keystore itself, and **Key Password** (if set) unlocks the private key inside it. Both must match the values configured for this keystore on your Kafka side.

The connection is rejected if required combinations are incomplete, such as:

* Truststore location without a truststore password.
* Keystore location without a keystore password.
* `ssl.key.password` provided without a keystore.

TLS / SSL fields cannot be set on non‑TLS protocols such as SASL_PLAINTEXT or PLAINTEXT; such combinations are rejected.

> **Note**
>
> File size limit: Truststore and keystore uploads are limited to 1 MB of decoded content. If you upload a larger file, the connection test or save will fail with an error indicating that the SSL file exceeds the maximum size.

If you set the **Security Protocol** to **PLAINTEXT**, no authentication or TLS settings are required.

* The wizard displays a warning that PLAINTEXT sends data unencrypted with no authentication and should only be used in development or fully trusted networks.
* SASL properties (`sasl.mechanism`, `sasl.jaas.config`) and SSL properties are not allowed on PLAINTEXT connections and are rejected if present.

Click **Save & Continue**.