# Configure Security Properties using Prefixes in Confluent Platform ## Configuration Parameters Each component and many areas of functionality (for example, audit logging) in Confluent Platform can be configured for security. This table shows what prefixes are used for security configuration properties and where to configure them. #### IMPORTANT Secrets `config.providers` do not propagate to prefixes such as `client.*`. Thus, when using prefixes with secrets you must specify `config.providers` and `config.providers.securepass.class`. Refer to [Using prefixes in secrets configurations](../security/compliance/secrets/overview.md#secrets-prefixes) for details. | Security Configuration | Prefix | Where to Configure | |-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------| | Audit logging | `confluent.security.event.` | `etc/kafka/server.properties` | | Broker | none | `etc/kafka/server.properties` | | Broker LDAP configurations | `ldap.` | `etc/kafka/server.properties` | | Broker Metadata Service (MDS) back-end configurations | `confluent.metadata.` | `etc/kafka/server.properties` | | Metadata Service (MDS) configurations | `confluent.metadata.server.` | `etc/kafka/server.properties` | | Console Clients | none | `client properties` (for example, `producer.config` or `consumer.config`) | | Connect workers | none, `producer.`, `consumer.`, or `admin.` | `etc/kafka/connect-distributed.properties` | | Control Center | `confluent.controlcenter.streams.`
`confluent.controlcenter.connect.`
`confluent.controlcenter.ksql.` | `etc/confluent-control-center/control-center.properties` | | Java Clients | Java clients use static parameters defined in the
Javadoc:

- [SSL](/platform/current/clients/javadocs/javadoc/org/apache/kafka/common/config/SslConfigs.html)
- [SASL](/platform/current/clients/javadocs/javadoc/org/apache/kafka/common/config/SaslConfigs.html) | SslConfigs or SaslConfigs in Properties class | | Metrics Reporter | `confluent.metrics.reporter.` | `etc/kafka/server.properties` | | Rebalancer | `confluent.rebalancer.metrics.` | Pass configuration (e.g. `rebalance-metrics-client.properties`) using `--config-file` | | Replicator | - `dest.kafka.`
- `src.kafka.` | connector JSON file (not the worker properties file) | | REST Proxy | `client.` | `etc/kafka/kafka-rest.properties` | | Schema Registry | `kafkastore.` | `etc/schema-registry/schema-registry.properties` | ## Environment Variables for Configuring HTTPS If a component in Confluent Platform needs to connect to a service using HTTPS, for example to an HTTPS-enabled Confluent Schema Registry, you may need to configure the [TLS/SSL credentials for that HTTPS connection](../schema-registry/security/index.md#sr-https-additional). This table shows for each component, the name of the environment variable to configure with TLS/SSL credentials for those HTTPS connections. | Component | Environment Variable | |----------------------|------------------------| | Broker | `KAFKA_OPTS` | | Console Clients | `KAFKA_OPTS` | | ksqlDB | `KSQL_OPTS` | | Connect workers | `KAFKA_OPTS` | | Confluent Rebalancer | `REBALANCER_OPTS` | | Control Center | `CONTROL_CENTER_OPTS` | | Schema Registry | `SCHEMA_REGISTRY_OPTS` | | REST Proxy | `KAFKAREST_OPTS` | ## Additional Environment Variables If you are using the Schema Registry [ACL Authorizer with SASL](../confluent-security-plugins/schema-registry/authorization/sracl_authorizer.md#confluentsecurityplugins-sracl-authorizer), pass in the JAAS configuration file using the `SECURITY_PLUGINS_OPTS` environment variable before calling `sr-acl-cli`. ```bash export SECURITY_PLUGINS_OPTS=-Djava.security.auth.login.config=/etc/schema-registry/kafka_client_jaas.conf ```