Configuration Reference for Schema Registry Clients on Confluent Platform
Schema Registry clients accept the following configuration options. Add them as properties to your producer and consumer configuration files, or pass them on the command line for testing.
For examples of these options in use, see Avro, Protobuf, and JSON Schema in Formats, Serializers, and Deserializers for Schema Registry on Confluent Platform.
schema.registry.url
Comma-separated list of URLs for Schema Registry instances.
Type: list
Default: null
Importance: high
max.retries
Maximum number of client retries.
Type: int
Default: 3
Valid Values: [0,…]
Importance: low
Tip
On Confluent Platform, this property first shipped in 7.4.9, 7.5.8, 7.6.5, 7.7.3, 7.8.2, and 7.9.0. All subsequent versions include it.
retries.wait.ms
Initial time in milliseconds that the Schema Registry client waits before the first retry. The default is 1,000 milliseconds, or one second.
Type: int
Default: 1000
Valid Values: [0,…]
Importance: low
Tip
On Confluent Platform, this property first shipped in 7.4.9, 7.5.8, 7.6.5, 7.7.3, 7.8.2, and 7.9.0. All subsequent versions include it.
retries.max.wait.ms
Maximum time in milliseconds that the Schema Registry client waits before any retry. The default is 2,000 milliseconds, or two seconds.
Type: int
Default: 2000
Valid Values: [0,…]
Importance: low
Tip
On Confluent Platform, this property first shipped in 7.4.9, 7.5.8, 7.6.5, 7.7.3, 7.8.2, and 7.9.0. All subsequent versions include it.
schema.registry.url.randomize
Whether to randomize the starting index of the Schema Registry URL list. Randomizing can balance load when many Schema Registry clients share a configuration that lists more than one server URL.
Type: boolean
Default: false
Importance: low
Tip
On Confluent Platform, this property first shipped in 7.7.4, 7.8.3, and 7.9.1. All subsequent versions include it.
basic.auth.credentials.source
Specifies how to pick the credentials for the Basic authentication header. The
supported values are URL, USER_INFO, and SASL_INHERIT.
Type: string
Default: “URL”
Importance: medium
The values work as follows:
URLThe user information is part of the
schema.registry.urlconfiguration, in the formhttp://<username>:<password>@sr-host:<sr-port>.USER_INFOThe user information is in basic.auth.user.info.
SASL_INHERITThe client inherits the settings that the Kafka client uses to communicate with the broker using SASL SCRAM or SASL PLAIN.
For an example of using a credentials file to authenticate a consumer to Schema Registry, see Print schema IDs with command line consumer utilities.
For more examples and details on credentials files on both Confluent Cloud and Confluent Platform, see the “Prerequisites” sections in each of the “Test Drives” for the different schema formats:
basic.auth.user.info
Specifies the credentials for Basic authentication in the form
user:password. Use this property when basic.auth.credentials.source is
USER_INFO.
Type: password
Default: “”
Importance: medium
http.connect.timeout.ms
Specifies the HTTP connection timeout in milliseconds for the Schema Registry client. The default is 60000 milliseconds (60 seconds).
Type: int
Default: 60000
Valid Values: [0,…]
Importance: low
http.read.timeout.ms
Specifies the HTTP read timeout in milliseconds for the Schema Registry client.
Type: int
Default: 60000
Valid Values: [0,…]
Importance: low
bearer.auth.token
Specifies the bearer token to be used for authentication.
Type: password
Default: “”
Importance: medium
proxy.host
The hostname or address of the proxy server that the client uses to connect to Schema Registry instances.
Type: string
Default: “”
Importance: low
proxy.port
The port number of the proxy server that the client uses to connect to Schema Registry instances.
Type: int
Default: “-1”
Importance: low
bearer.auth.credentials.source
Specifies how to pick the credentials for bearer authentication.
Type: string
Default: “STATIC_TOKEN”
Importance: medium
bearer.auth.issuer.endpoint.url
The HTTP(S)-based URL for the OAuth/OIDC identity provider which issues access tokens.
Type: string
Default: “null”
Importance: medium
bearer.auth.client.id
Client ID used to obtain client credentials grant from OAuth/OIDC identity provider.
Type: string
Default: “null”
Importance: medium
bearer.auth.client.secret
The client secret used to obtain client credentials grant from OAuth/OIDC identity provider.
Type: password
Default: “null”
Importance: medium
bearer.auth.scope
The access token scope used to obtain client credentials grant from OAuth/OIDC identity provider.
Type: string
Default: “null”
Importance: medium
bearer.auth.scope.claim.name
The OAuth claim for the scope is often named scope. Set this optional
property to use a different name for the scope claim in the JWT payload, if the
OAuth/OIDC provider names it differently.
Type: string
Default: “scope”
Importance: low
bearer.auth.sub.claim.name
The OAuth claim for the subject is often named sub. Set this optional
property to use a different name for the subject claim in the JWT payload, if
the OAuth/OIDC provider names it differently.
Type: string
Default: “sub”
Importance: low
bearer.auth.logical.cluster
Optional property to add to the request header to identify the logical cluster.
Type: string
Default: “null”
Importance: medium
bearer.auth.identity.pool.id
Optional property to add to the request header to identify the principal ID for authorization.
Type: string
Default: “null”
Importance: medium
bearer.auth.cache.expiry.buffer.seconds
The amount of buffer time between the expiration time of the OAuth token and the expiration of the cache that holds the token. Ideally, the client gets a new token before the current one expires. Legal values are 0 to 3,600 (one hour), and the default is 300 (five minutes). The client ignores this value if it exceeds the remaining lifetime of the token when the client retrieves it.
Type: short
Default: “300”
Valid Values: [0, 3600]
Importance: low
bearer.auth.custom.provider.class
Custom class that provides the token credential. The class must implement the
io.confluent.kafka.schemaregistry.client.security.bearerauth.BearerAuthCredentialProvider
interface.
Type: string
Default: “null”
Importance: medium
ssl.protocol
The SSL protocol used to generate the SSLContext. The default is TLSv1.3
when running with Java 11 or later and TLSv1.2 otherwise. This value works
for most use cases. Allowed values in recent JVMs are TLSv1.2 and
TLSv1.3. Older JVMs might support TLS, TLSv1.1, SSL, SSLv2,
and SSLv3, but you shouldn’t use them because of known security
vulnerabilities. With the default value for this configuration and
ssl.enabled.protocols, clients downgrade to TLSv1.2 if the
server doesn’t support TLSv1.3. If you set this configuration to
TLSv1.2, clients don’t use TLSv1.3, even if TLSv1.3 is in
ssl.enabled.protocols and the server supports only TLSv1.3.
Type: string
Default: “TLSv1.3”
Importance: medium
ssl.provider
The name of the security provider used for SSL connections. Default value is the default security provider of the Java Virtual Machine (JVM).
Type: string
Default: “null”
Importance: medium
ssl.cipher.suites
A list of cipher suites. A cipher suite is a named combination of authentication, encryption, MAC, and key exchange algorithms. The client uses it to negotiate the security settings for a network connection using TLS or SSL. By default, the client supports all available cipher suites.
Type: list
Default: “null”
Importance: low
ssl.enabled.protocols
The comma-separated list of protocols enabled for SSL connections. The default
is TLSv1.2,TLSv1.3 when running with Java 11 or later and TLSv1.2
otherwise. With the default value for Java 11, if both the client and the server
support TLSv1.3, they prefer it. Otherwise, they fall back to TLSv1.2,
assuming both support at least TLSv1.2. To learn how this setting interacts
with ssl.protocol, see ssl.protocol.
Type: list
Default: “TLSv1.2, TLSv1.3”
Importance: medium
ssl.keystore.type
The file format of the keystore file. This property is optional for clients.
The default ssl.engine.factory.class supports JKS, PKCS12, and
PEM.
Type: string
Default: “JKS”
Importance: medium
ssl.keystore.key
Private key in the format specified by ssl.keystore.type. The
default SSL engine factory supports only the PEM format with PKCS#8 keys. For an
encrypted key, specify the key password using ssl.key.password.
Type: password
Default: “null”
Importance: high
ssl.keystore.certificate.chain
Certificate chain in the format specified by ssl.keystore.type. The default SSL engine factory supports only the PEM format with a list of X.509 certificates.
Type: password
Default: “null”
Importance: high
ssl.truststore.certificates
Trusted certificates in the format specified by ssl.truststore.type. The default SSL engine factory supports only the PEM format with X.509 certificates.
Type: password
Default: “null”
Importance: high
ssl.keystore.location
The location of the key store file. This is optional for client and can be used for two-way authentication for client.
If ssl.keystore.type is PEM, set this to a PEM file that contains the private key and the certificate chain.
Don’t also set ssl.keystore.key or ssl.keystore.certificate.chain.
Type: string
Default: “null”
Importance: high
ssl.keystore.password
The store password for the keystore file. This property is optional for clients and needed only if you configure ssl.keystore.location. The PEM format doesn’t support a keystore password.
Type: password
Default: “null”
Importance: high
ssl.key.password
The password of the private key in the key store file or the PEM key specified in ssl.keystore.key.
Type: password
Default: “”
Importance: high
ssl.truststore.type
The file format of the truststore file. The default
ssl.engine.factory.class supports JKS, PKCS12, and PEM.
Type: string
Default: “JKS”
Importance: medium
ssl.truststore.location
The location of the trust store file.
If ssl.truststore.type is PEM, set this to a PEM file that contains the trusted X.509 certificates.
Don’t also set ssl.truststore.certificates.
Type: string
Default: “null”
Importance: high
ssl.truststore.password
The password for the truststore file. If you don’t set a password, the client still uses the configured truststore file, but integrity checking is off. The PEM format doesn’t support a truststore password.
Type: password
Default: “null”
Importance: high
ssl.keymanager.algorithm
The algorithm used by the key manager factory for SSL connections. The default is the key manager factory algorithm configured for the JVM.
Type: string
Default: the key manager factory algorithm configured for the JVM
Importance: low
ssl.trustmanager.algorithm
The algorithm used by the trust manager factory for SSL connections. The default is the trust manager factory algorithm configured for the JVM.
Type: string
Default: the trust manager factory algorithm configured for the JVM
Importance: low
ssl.endpoint.identification.algorithm
The endpoint identification algorithm used to validate the server hostname using the server certificate.
Type: string
Default: “HTTPS”
Importance: low
ssl.secure.random.implementation
The SecureRandom PRNG implementation to use for SSL cryptography operations.
Type: string
Default: “null”
Importance: low
ssl.engine.factory.class
The class of type org.apache.kafka.common.security.auth.SslEngineFactory to provide SSLEngine objects. The default value is org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.
Type: class
Default: “null”
Importance: low
Configure mTLS with PEM files
A Java client can use PEM files on disk for mTLS.
Set ssl.keystore.type and ssl.truststore.type to PEM.
Point ssl.keystore.location and ssl.truststore.location at the files.
Prefix each property with schema.registry..
schema.registry.url=https://<sr-host>:8081
schema.registry.ssl.keystore.type=PEM
schema.registry.ssl.keystore.location=/etc/kafka/secrets/client-keystore.pem
schema.registry.ssl.key.password=<key-password>
schema.registry.ssl.truststore.type=PEM
schema.registry.ssl.truststore.location=/etc/kafka/secrets/ca.pem
The PEM files must meet these requirements:
The
ssl.keystore.locationfile contains both the private key and the certificate chain.The private key is in PKCS#8 format.
The
ssl.truststore.locationfile contains only X.509 certificates.
Set ssl.key.password only for an encrypted private key.
Don’t set ssl.keystore.password or ssl.truststore.password with PEM files.
You can also embed the PEM contents directly in the configuration with ssl.keystore.key,
ssl.keystore.certificate.chain, and ssl.truststore.certificates.