HTTP Basic Auth

You can add HTTP basic authentication to these Confluent Platform components:

Control Center REST API

User login is available using HTTP Basic Authentication that is pluggable using JAAS. All of the configuration options are documented here.

To configure Control Center authentication:

  1. Specify the following options in,Restricted
  2. Create a JAAS file (propertyfile.jaas) similar to the following–note that the authentication realm is Control Center (c3):

    c3 {
        org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required

    Your password file in should look similar to the following:

    bob: <bob_password>,Administrators
    alice: <alice_password>,Restricted
  3. Start Control Center to use the JAAS configuration:

    CONTROL_CENTER_OPTS="" control-center-start /

After you are granted access to Control Center, you are prompted for sign-in credentials. Logging in as bob:<bob_password> provides read and write access. Logging in as alice:<alice_password> provides read-only access.


HTTPS is supported for web access to Confluent Control Center. To enable HTTPS, you must first add an HTTPS listener in the Control Center properties file using the parameter. You must also set the appropriate SSL configuration options. If you haven’t already, this would be a good time to create SSL keys and certificates.

An example of the necessary additions to are shown below:
   curl -vvv -X GET --tlsv1.2 https://localhost:9022
#for cases when using a self-signed certificate
   curl -vvv -X GET --tlsv1.2 --cacert scripts/security/snakeoil-ca-1.crt https://localhost:9022

See also

For an example that shows this in action, see the Confluent Platform demo. Refer to the demo’s docker-compose.yml for a configuration reference.

REST Proxy

  1. Add the following configuration to your REST Proxy properties file (etc/kafka-rest/

  2. Create a JAAS configuration file. For an example, see etc/kafka-rest/etc/kafka-rest/

    KafkaServer {
        org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required


    KafkaServer is in line with the realm specified as authentication.realm in

  3. Create a password properties file (<path-to-confluent>/etc/kafka-rest/ For example:

    thisismyusername: thisismypass,thisismyrole
  4. Start REST Proxy with HTTP Basic auth:

    KAFKAREST_OPTS="<path-to-confluent>/etc/kafka-rest/" \
    bin/kafka-rest-start etc/kafka-rest/
  5. Configure HTTPS for the REST Proxy interface.

  6. Login to your REST Proxy with the username thisismyusername and the password thisismypass. The password in your file can also be hashed. For more information, see this link.

Connect REST API

  1. Add the following configuration to your Connect worker properties file (etc/kafka/connect-distributed.propertes):
  2. Create a JAAS configuration file. Your authentication realm is hardcoded to KafkaConnect, so your JAAS must look like this:

    KafkaConnect { required
  3. Export KAFKA_OPTS with the path to the JAAS configuration file:

    export KAFKA_OPTS="<path-to-jaas-file>"
  4. Create a password properties file (<path-to-confluent>/etc/kafka/connect.password). For example:

    thisismyusername: thisismypass,thisismyrole


  1. Add the following configuration in your KSQL properties file (etc/ksql/

  2. Create a JAAS file (jaas_config.file):

    KsqlServer-Props {
      org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
  3. Create a password properties file (<path-to-confluent>/etc/ksql/password-file):

    fred: OBF:1w8t1tvf1w261w8v1w1c1tvn1w8x,user,admin
    harry: changeme,user,developer
    tom: MD5:164c88b302622e17050af52c89945d44,user
    dick: CRYPT:adpexzg3FUZAk,admin,ksq-user
  4. Export the JAAS file:

  5. Start the KSQL server:

    <path-to-confluent>/bin/ksql-server-start <path-to-confluent>/etc/ksql/

For more information, see Configuring the CLI for Basic HTTP Authentication.

Schema Registry

Schema Registry can be configured to require users to authenticate using a username and password via the Basic HTTP authentication mechanism.


If you’re using Basic authentication, we recommended that you configure Schema Registry to use HTTPS for secure communication, because the Basic protocol passes credentials in plain text.

Use the following settings to configure Schema Registry to require authentication:


The authentication.roles config defines a comma-separated list of user roles. To be authorized to access Schema Registry, an authenticated user must belong to at least one of these roles.

For example, if you define admin, developer, user, and sr-user roles, the following configuration assigns them for authentication:


The authentication.realm config must match a section within jaas_config.file, which defines how the server authenticates users and should be passed as a JVM option during server start:

<path-to-confluent>/bin/schema-registry-start <path-to-confluent>/etc/schema-registry/

An example jaas_config.file is:

SchemaRegistry-Props {
  org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required

Assign the SchemaRegistry-Props section to the authentication.realm config setting:


The example jaas_config.file above uses the Jetty PropertyFileLoginModule, which authenticates users by checking for their credentials in a password file.

You can also use other implementations of the standard Java LoginModule interface, such as the LdapLoginModule, or the JDBCLoginModule for reading credentials from a database.

The file parameter is the location of the password file, The format is:

<username>: <password-hash>[,<rolename> ...]

Here’s an example:

fred: OBF:1w8t1tvf1w261w8v1w1c1tvn1w8x,user,admin
barney: changeme,user,developer
betty: MD5:164c88b302622e17050af52c89945d44,user
wilma: CRYPT:adpexzg3FUZAk,admin,sr-user

Get the password hash for a user by using the utility:

bin/schema-registry-run-class fred letmein

Your output should resemble:


Each line of the output is the password encrypted using different mechanisms, starting with plain text.

Once Schema Registry is configured to use Basic authentication, clients must be configured with suitable valid credentials, for example:



The schema.registry prefixed versions of these properties were deprecated in Confluent Platform 5.0.

  • schema.registry.basic.auth.credentials.source is deprecated.
  • is deprecated.

For more information, see Schema Registry Security Overview.