<a id="controlcenter-security-sasl"></a>

# Configure SASL for Control Center on Confluent Platform

Many of the concepts applied here [come from the Kafka Security documentation](/platform/current/security/authentication/overview.html#kafka-sasl-auth). Reading through and understanding
that documentation will be useful in configuring Control Center for SASL.

The following assumes that this is for a development setup only and generically
followed the
[Quick Start for Confluent Platform](/platform/current/get-started/platform-quickstart.html#quickstart). While the specifics are for development purposes only,
securing a production cluster follows the same concepts.

## ZooKeeper

For the purposes here, ZooKeeper will not be secured. This guide is targeted to securing the immediately dependent
pieces of the Control Center. If you would like to secure ZooKeeper as well, you can
[check out the documentation](/platform/current/security/authentication/overview.html#kafka-sasl-auth)

<a id="controlcenter-sasl-broker"></a>

### Kafka Broker

Create a new file to and put the `KafkaServer` configuration into it. The `KafkaServer` section is for the authentication on brokers.
For this example, create it at `/tmp/kafka_server_jaas.conf`.

```bash
KafkaServer {
  org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin-secret"
  user_admin="admin-secret"
  user_confluent="confluent-secret"
  user_metricsreporter="metricsreporter-secret";
};

KafkaClient {
  org.apache.kafka.common.security.plain.PlainLoginModule required
  username="metricsreporter"
  password="metricsreporter-secret";
};
```

This configures several users on the server:
: - an `admin` user for internal interbroker traffic
  - a `confluent` user, for Confluent Control Center, Kafka Connect, and Schema Registry
  - a `metricsreporter` user for Metrics Reporter to publish Apache Kafka® metrics

In this example, Metrics Reporter publishes metrics to the same cluster it is configured on,
so we also need to include the corresponding `KafkaClient` client configuration in the same file.

It is possible to pass the JAAS configuration file location as JVM parameter to each client JVM as

```bash
-Djava.security.auth.login.config=/tmp/kafka_server_jaas.conf
```

Next, secure the Kafka broker, the monitoring interceptor and the metrics reporter. There are
[more options for security](/platform/current/security/overview.html#security), but this broker will be secured using `SASL_PLAINTEXT`.

#### NOTE
These values should be updated or added in your Kafka broker properties file `CONFLUENT_HOME/etc/kafka/server.properties`

```bash
############# Broker Security ##############
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.enabled.mechanisms=PLAIN
listeners=SASL_PLAINTEXT://:9092

############# Confluent Metrics Reporter Security ##############
confluent.metrics.reporter.sasl.mechanism=PLAIN
confluent.metrics.reporter.security.protocol=SASL_PLAINTEXT
```

In this example, using the Control Center quick start is assumed, so the metrics reporter and the monitoring interceptor
are configured.

#### NOTE
Anything that is set for the `confluent.metrics.reporter.` prefix must be set explicitly.

Start the broker with the updated configuration with `KAFKA_OPTS` pointing to the JAAS file using the
[confluent local services start](https://docs.confluent.io/confluent-cli/current/command-reference/local/services/confluent_local_services_start.html) command.

```bash
KAFKA_OPTS=-Djava.security.auth.login.config=/tmp/kafka_server_jaas.conf \
confluent local services kafka start
```

<a id="controlcenter-sasl-c3"></a>

### Control Center Configuration

Create a file with a `KafkaClient` entry at `/tmp/kafka_client_jaas.conf`. The `KafkaClient` section of
is where the principal for the client needs to be specified. This will be used later to authenticate the Control Center and Kafka Connect.

<a id="controlcenter-security-kafkaclient"></a>
```bash
KafkaClient {
  org.apache.kafka.common.security.plain.PlainLoginModule required
  username="confluent"
  password="confluent-secret";
};
```

It is possible to pass the JAAS configuration file location as JVM parameter to each client JVM as

```bash
-Djava.security.auth.login.config=/tmp/kafka_client_jaas.conf
```

This will allow the `confluent.monitoring.interceptor.` and `confluent.metrics.reporter.` to communicate with the secured Kafka broker. Any broker with the
`confluent.monitoring.interceptor.` or `confluent.metrics.reporter.` will need to have a valid `KafkaClient` section in the JAAS config.

The Control Center needs to know that security is enabled. Internally, the Control Center uses Kafka Streams as a state store, so with a secured broker, they
also need to be secured.

Edit the `CONFLUENT_HOME/etc/confluent-control-center/control-center.properties`:

```bash
########### Control Center security ###########
confluent.controlcenter.streams.sasl.mechanism=PLAIN
confluent.controlcenter.streams.security.protocol=SASL_PLAINTEXT
```

The Control Center can be now be started

```bash
CONTROL_CENTER_OPTS=-Djava.security.auth.login.config=/tmp/kafka_client_jaas.conf \
control-center-start ${CONFLUENT_HOME}/etc/confluent-control-center/control-center.properties
```

<a id="controlcenter-sasl-connect"></a>

### Schema Registry Configuration

If you followed the quick start, Connect relies on Schema Registry,
so we first need to update Schema Registry to use SASL authentication.

Edit the Schema Registry configuration (`CONFLUENT_HOME/etc/schema-registry/schema-registry.properties`) and add the following settings.

```bash
kafkastore.security.protocol=SASL_PLAINTEXT
kafkastore.sasl.mechanism=PLAIN
```

Start schema registry with the additional `SCHEMA_REGISTRY_OPTS` parameter with the JAAS file [created ealier](#controlcenter-security-kafkaclient).

```bash
SCHEMA_REGISTRY_OPTS=-Djava.security.auth.login.config=/tmp/kafka_client_jaas.conf \
confluent local services schema-registry start
```

### Connect Configuration

The Connect properties file
(`/CONFLUENT_HOME/etc/schema-registry/connect-avro-distributed.properties`)
must be configured to use the same security protocol as the Kafka broker. For this example, `SASL_PLAINTEXT` is used for the producer, consumer, the producer monitoring interceptor, and the consumer monitoring interceptor.

```bash
#### Base connect security ####
security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN

#### Connect producer ####
producer.sasl.mechanism=PLAIN
producer.security.protocol=SASL_PLAINTEXT

#### Connect consumer ####
consumer.sasl.mechanism=PLAIN
consumer.security.protocol=SASL_PLAINTEXT

#### Monitoring producer interceptor ####
producer.confluent.monitoring.interceptor.sasl.mechanism=PLAIN
producer.confluent.monitoring.interceptor.security.protocol=SASL_PLAINTEXT

#### Monitoring consumer interceptor ####
consumer.confluent.monitoring.interceptor.sasl.mechanism=PLAIN
consumer.confluent.monitoring.interceptor.security.protocol=SASL_PLAINTEXT
```

#### NOTE
For any custom clients on the Control Center, these settings can be set for that producer’s or consumer’s prefix.

Once Connect security is configured, start Connect with the `CONNECT_OPTS` parameter with the JAAS file [that was created here](#controlcenter-security-kafkaclient).

```bash
CONNECT_OPTS=-Djava.security.auth.login.config=/tmp/kafka_client_jaas.conf \
confluent local services connect start
```