<a id="kafka-rest-security-plugins-install"></a>

# REST Proxy Security Plugins in Confluent Platform

<!-- used in confluent-security-plugins/kafka-rest/introduction and security/nav-rest-proxy-security -->

Confluent REST Proxy allows producing and consuming messages of different formats
through a REST interface. The security plugin provides the capability to
authenticate an incoming request, build the principal, and then propagate the
same requests to Apache Kafka® using the configured security mechanism. The
authorization is enforced through Kafka ACLs, which provide granular access
controls based on Kafka’s ACL  implementation (such as limiting access to topics,
in which case the client  principal is propagated to Kafka and has the same
access as if connected with  that principal in any other client).

When enabled with role-based access control (RBAC) or [Kafka REST Security plugins](#kafka-rest-security-plugins-install),
license clients must be explicitly configured to authenticate to Kafka. To learn more, see [Configure license clients to authenticate to Kafka](../installation/license.md#kafka-rest-and-sasl-ssl-configs)
in the Confluent Platform license documentation.

## Install

<!-- start-install-share -->

#### IMPORTANT
This software is available under a
[Confluent enterprise license](https://www.confluent.io/product/confluent-enterprise/). You can use
this software for a 30-day trial period without a license key. If you are a subscriber, contact
[Confluent Support](https://support.confluent.io/).

<!-- end-license -->

The Confluent security plugins are an extension to Confluent Platform components. The security plugins are installed by default if you are
using ZIP and TAR archives, but must be installed manually if you are using DEB or RPM packages.

If not already installed, you must install the plugin so that Confluent Enterprise can detect your REST Proxy license
and REST Proxy can operate as expected.

The default location for the Confluent REST Proxy Security Plugins is:

```bash
${CONFLUENT_HOME}/share/java/kafka-rest/confluent-security-plugins-common-<version>.jar
${CONFLUENT_HOME}/share/java/kafka-rest/confluent-kafka-rest-security-plugin-<version>.jar
```

### ZIP and TAR Archives

If you installed Confluent Platform by using [ZIP or TAR archives](../installation/installing_cp/zip-tar.md#prod-kafka-cli-install) or a [Docker image](../installation/docker/installation.md#cpdocker-intro), the security plugins are installed by
default and are located in `CONFLUENT_HOME/share/java/` in the individual component directories.

### Ubuntu and Debian

If you installed Confluent Platform in a [Ubuntu or Debian environment](../installation/installing_cp/deb-ubuntu.md#systemd-ubuntu-debian-install), you must install the plugins separately with this command:

```bash
sudo apt-get update && sudo apt-get install confluent-security
```

### RHEL and CentOS

If you installed Confluent Platform in a [RHEL, CentOS, or Fedora-based environment](../installation/installing_cp/rhel-centos.md#systemd-rhel-centos-install), you must
install the plugins separately with this command:

```bash
sudo yum install confluent-security
```

## Activate

After the installation is complete, you must add the following configuration in
the Confluent REST Proxy configuration file (`/etc/kafka-rest/kafka-rest.properties`)
to activate the plugins.

```bash
kafka.rest.resource.extension.class=io.confluent.kafkarest.security.KafkaRestSecurityResourceExtension
```

`kafka.rest.resource.extension.class`
: Fully qualified class name of a valid implementation of the interface RestResourceExtension.
  Use this to inject user-defined resources such as filters. Typically used to add custom
  capabilities such as logging, security, etc.
  <br/>
  * Type: string
  * Default: “”
  * Importance: low

## Usage

For information on how to leverage the REST Proxy Security Plugins to propagate credentials from REST Proxy
to Kafka brokers, see [REST Proxy Credentials Propagation](../kafka-rest/production-deployment/rest-proxy/security.md#kafka-rest-security-propagation).