# Use HTTP Basic Authentication in Confluent Platform You can add [HTTP Basic authentication](https://tools.ietf.org/html/rfc7617) to these Confluent Platform components: - [REST Proxy](#basic-auth-crest) - [Connect REST API](#basic-auth-kconnect) - [ksqlDB](#basic-auth-ksql) - [Schema Registry](#basic-auth-sr) - [Control Center](#basic-auth-c3) #### NOTE [Role-based access control (RBAC)](../../authorization/rbac/overview.md#rbac-overview) can be used to support security for all components. For details, see [Kafka Connect and RBAC for Confluent Platform](../../../connect/rbac-index.md#connect-rbac-index). ## REST Proxy See [REST Proxy HTTP Basic authentication](../../../kafka-rest/production-deployment/rest-proxy/security.md#kafka-rest-security-http-auth-basic). ## Connect REST API 1. Add the following configuration to your Connect worker properties file (`etc/kafka/connect-distributed.properties`): ```none rest.extension.classes=org.apache.kafka.connect.rest.basic.auth.extension.BasicAuthSecurityRestExtension ``` 2. Create a JAAS configuration file. Your authentication realm is hardcoded to `KafkaConnect`, so your JAAS must look like this: ```none KafkaConnect { org.apache.kafka.connect.rest.basic.auth.extension.PropertyFileLoginModule required file="${CONFLUENT_HOME}/etc/kafka/connect.password"; }; ``` 3. Export `KAFKA_OPTS` with the path to the JAAS configuration file: ```none export KAFKA_OPTS="-Djava.security.auth.login.config=" ``` 4. Create a password properties file (`CONFLUENT_HOME/etc/kafka/connect.password`). For example: ```none thisismyusername: thisismypass ``` ## ksqlDB 1. Add the following configuration in your ksqlDB properties file (`etc/ksqldb/ksql-server.properties`): ```none authentication.method=BASIC authentication.roles=admin,developer,user,ksq-user authentication.realm=KsqlServer-Props ``` 2. Create a JAAS file (`jaas_config.conf`): ```none KsqlServer-Props { org.eclipse.jetty.security.jaas.spi.PropertyFileLoginModule required file="/path/to/password-file" debug="false"; }; ``` 3. Create a password properties file (`CONFLUENT_HOME/etc/ksqldb/password-file`). The file parameter is the location of the password file. The format is: ```none : ,[,,...] ``` Following is an example: ```none fred: OBF:1w8t1tvf1w261w8v1w1c1tvn1w8x,user,admin harry: changeme,user,developer tom: MD5:164c88b302622e17050af52c89945d44,user dick: CRYPT:adpexzg3FUZAk,admin,ksq-user ``` 4. Export the JAAS file: ```none export KSQL_OPTS=-Djava.security.auth.login.config=/path/to/the/jaas_config.conf ``` 5. Start the ksqlDB server: ```none ksql-server-start ${CONFLUENT_HOME}/etc/ksqldb/ksql-server.properties ``` For more information, see [Configure ksqlDB for Basic HTTP authentication](../../../ksqldb/operate-and-deploy/installation/security.md#ksqldb-installation-security-configuring-listener-for-http-basic). ## Schema Registry Schema Registry can be configured to require users to authenticate using a username and password via the Basic HTTP authentication mechanism. #### NOTE If you’re using Basic authentication, we recommended that you [configure Schema Registry to use HTTPS for secure communication](../../../schema-registry/security/index.md#schema-registry-http-https), because the Basic protocol passes credentials in plain text. Use the following settings to configure Schema Registry to require authentication: ```none authentication.method=BASIC authentication.roles=,,... authentication.realm= ``` The `authentication.roles` configuration defines a comma-separated list of user roles. To be authorized to access Schema Registry, an authenticated user must belong to at least one of these roles. For example, if you define `admin`, `developer`, `user`, and `sr-user` roles, the following configuration assigns them for authentication: ```none authentication.roles=admin,developer,user,sr-user ``` The `authentication.realm` configuration must match a section within `jaas_config.conf`, which defines how the server authenticates users and should be passed as a JVM option during server start: ```bash export SCHEMA_REGISTRY_OPTS=-Djava.security.auth.login.config=/path/to/the/jaas_config.conf schema-registry-start ${CONFLUENT_HOME}/etc/schema-registry/schema-registry.properties ``` An example `jaas_config.conf` is: ```none SchemaRegistry-Props { org.eclipse.jetty.security.jaas.spi.PropertyFileLoginModule required file="/path/to/password-file" debug="false"; }; ``` Assign the `SchemaRegistry-Props` section to the `authentication.realm` configuration setting: ```none authentication.realm=SchemaRegistry-Props ``` The example `jaas_config.conf` above uses the Jetty `PropertyFileLoginModule`, which authenticates users by checking for their credentials in a password file. You can also use other implementations of the standard Java `LoginModule` interface, such as the `LdapLoginModule`, or the `JDBCLoginModule` for reading credentials from a database. The file parameter is the location of the password file. The format is: ```none : ,[,,...] ``` Here’s an example: ```none fred: OBF:1w8t1tvf1w261w8v1w1c1tvn1w8x,user,admin barney: changeme,user,developer betty: MD5:164c88b302622e17050af52c89945d44,user wilma: CRYPT:adpexzg3FUZAk,admin,sr-user ``` Get the password hash for a user by using the `org.eclipse.jetty.util.security.Password` utility: ```bash schema-registry-run-class org.eclipse.jetty.util.security.Password fred letmein ``` Your output should resemble: ```none letmein OBF:1w8t1tvf1w261w8v1w1c1tvn1w8x MD5:0d107d09f5bbe40cade3de5c71e9e9b7 CRYPT:frd5btY/mvXo6 ``` Each line of the output is the password encrypted using different mechanisms, starting with plain text. Once Schema Registry is configured to use Basic authentication, clients must be configured with suitable valid credentials, for example: ```none basic.auth.credentials.source=USER_INFO basic.auth.user.info=fred:letmein ``` For more information, see [Secure Schema Registry for Confluent Platform](../../../schema-registry/security/index.md#schemaregistry-security). ## Control Center You can configure HTTP Basic authentication for Control Center or configure Control Center client authentication with other Confluent Platform components that have HTTP Basic authentication enabled. ### Basic authentication for Control Center You can require a user to log in to Control Center by configuring HTTP Basic authentication using Java Authentication and Authorization Service (JAAS). JAAS provides a pluggable model, with details specified at runtime. For details on all configuration options, see [UI authentication settings](https://docs.confluent.io/platform/current/control-center/installation/configuration.html#ui-authentication-settings). To configure Control Center authentication: 1. Specify the following options in the appropriate [Control Center property file](https://docs.confluent.io/control-center/current/installation/properties.html#c3-properties-files). Use the `confluent.controlcenter.rest.authentication.roles` and `confluent.controlcenter.auth.restricted.roles` to create groups of users; either administrators, which have full read and write access, or restricted users that have only read access. Restricted users cannot add or delete topics. - Specify values for `confluent.controlcenter.rest.authentication.roles` in the following format: `,` - The restricted value is the name of your restricted group: `confluent.controlcenter.auth.restricted.roles` is ``. ```bash confluent.controlcenter.rest.authentication.method=BASIC confluent.controlcenter.rest.authentication.realm=c3 confluent.controlcenter.rest.authentication.roles=Administrators,Restricted confluent.controlcenter.auth.restricted.roles=Restricted confluent.controlcenter.auth.session.expiration.ms=600000 ``` 2. Create a JAAS file (`propertyfile.jaas`) similar to the following. In the file, you specify the authentication realm as Control Center (`c3`), and provide the name of password file that will contain the Control Center users and passwords. ```bash c3 { org.eclipse.jetty.security.jaas.spi.PropertyFileLoginModule required file="/path/to/password.properties"; }; ``` Your password file in `password.properties` should look similar to the following, specifying a username followed by a password and that user’s group, either the administrative group or the restricted group. #### NOTE A user with membership in multiple groups is granted only the most restrictive permissions. For example, if a user is a member of two groups, `admin` and `readonly`, and `readonly` is a restricted role, then the user is granted only the rights for the `readonly` group. ```bash admin: , bob: , alice: , ``` 3. Start Control Center passing in an argument to use the JAAS configuration, and specify the properties file that contains the HTTP Basic authentication settings: ```bash CONTROL_CENTER_OPTS="-Djava.security.auth.login.config=/path/to/propertyfile.jaas" \ control-center-start ./etc/confluent-control-center/control-center.properties ``` When a user accesses Control Center, they are shown a dialog similar to the one that follows, which prompts them for sign-in credentials. ![image](images/c3-auth-sign-in.png) For this example, logging in as `bob:` provides read and write access. Logging in as `alice:` provides read-only access. #### Restricted users For users with restricted (read-only) roles, the following user interface (UI) features and options are unavailable/hidden: * Upload [Connect](https://docs.confluent.io/control-center/current/connect.html#controlcenter-userguide-connect) configs * Browse connectors * Add, delete, pause, or resume connectors * View connectors settings * Create, delete, or edit [alerts (triggers or actions)](https://docs.confluent.io/control-center/current/alerts/concepts.htmlcontrolcenter_userguide_alerts) * Edit licenses * Edit [brokers](https://docs.confluent.io/control-center/current/brokers.html#controlcenter-userguide-brokers) * Press submit on [cluster forms](https://docs.confluent.io/control-center/current/clusters.html#controlcenter-userguide-cluster-settings) * Edit, create, or delete schemas * [Inspect topics](https://docs.confluent.io/control-center/current/topics/messages.html#c3-topic-message-browser) * [Run or stop ksqlDB queries](https://docs.confluent.io/control-center/current/ksql.html#controlcenter-userguide-ksql) * Type in the ksqlDB editor * Add ksqlDB streams or tables #### SEE ALSO For an example that shows how to set Docker environment variables for Confluent Platform running on KRaft, see the [Confluent Platform demo](../../../tutorials/cp-demo/index.md#cp-demo). Refer to the demo’s [docker-compose.yml file](https://github.com/confluentinc/cp-demo/tree/latest/docker-compose.yml) for a configuration reference. ### Confluent Control Center and other components When HTTP Basic authentication is enabled on other Confluent Platform components, you must configure Control Center with a valid username and password for that component. #### HTTP Basic authentication enabled for Schema Registry Whenever you have HTTP Basic authentication configured for Schema Registry, you must provide a username and password for Control Center to communicate correctly with Schema Registry. For a single cluster or the first cluster in a multi-cluster deployment, set the following properties, where the `user.info` contains a `:` that you have configured for Schema Registry. ```bash confluent.controlcenter.schema.registry.basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry.basic.auth.user.info=: ``` For multi-cluster deployment, to set the remaining clusters, use: ```bash confluent.controlcenter.schema.registry..basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry..basic.auth.user.info=: ``` A multi-cluster deployment Schema Registry might look like the following: ```bash // first Schema Registry cluster confluent.controlcenter.schema.registry.url= confluent.controlcenter.schema.registry.basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry.basic.auth.user.info=: // additional Schema Registry clusters confluent.controlcenter.schema.registry..url= confluent.controlcenter.schema.registry..basic.auth.credentials.source=USER_INFO confluent.controlcenter.schema.registry..basic.auth.user.info=: ``` See [Schema Registry](#basic-auth-sr) for steps to configure HTTP Basic authentication for Schema Registry. #### HTTP Basic authentication for REST Proxy To learn about using HTTP Basic authentication with REST Proxy, see [HTTP Basic Authentication](../../../kafka-rest/production-deployment/rest-proxy/security.md#kafka-rest-security-http-auth-basic). #### HTTP Basic authentication enabled for Connect Whenever you have HTTP Basic authentication configured for Connect, you must provide a username and password for Control Center to communicate correctly with Connect. Set the `confluent.controlcenter.connect..basic.auth.user.info` property to a value that contains `:` that you have configured for Connect. ```bash confluent.controlcenter.connect..basic.auth.user.info=: ``` See [Connect REST API](#basic-auth-kconnect) for steps to configure HTTP Basic authentication for Connect. #### HTTP Basic authentication enabled for ksqlDB Whenever you have HTTP Basic authentication configured for ksqlDB, you must provide a username and password for Control Center to communicate correctly with ksqlDB. Set the `confluent.controlcenter.ksql..basic.auth.user.info` property to a value that contains `:` that you have configured for ksqlDB. ```bash confluent.controlcenter.ksql.ksql-cluster-name.basic.auth.user.info=: ``` See [ksqlDB](#basic-auth-ksql) for steps to configure HTTP Basic authentication for ksqlDB. ## Limitations and best practices - **Browser authentication behavior**. When HTTP Basic authentication is enabled, the browser authentication prompt behavior differs across Confluent Platform components. Schema Registry endpoints (for example, `http://localhost:8081/schemas`) prompt for credentials in the browser because Schema Registry sends the `WWW-Authenticate` response header. Connect endpoints (for example, `http://localhost:8083/`) and ksqlDB endpoints (for example, `http://localhost:8088/info`) do not display a browser authentication prompt. This is a known API limitation where these services do not send the `WWW-Authenticate` response header required to trigger the browser’s built-in credential dialog. - **Avoid accessing REST API endpoints directly in a browser to test or validate authentication**. Browsers rely on the `WWW-Authenticate` header to display the credential prompt, which not all Confluent Platform services provide. - **Use dedicated REST client tools**. Use dedicated REST client tools such as `curl` or Postman for interacting with Schema Registry, Connect, and ksqlDB REST APIs. These tools are the recommended method for API access because they support the full range of REST operations, including authentication, configuration, and management tasks, and allow you to explicitly set headers such as `Authorization` with your credentials. For example: ```bash curl -u : http://localhost:8083/connectors ``` - **Include authorization headers**. For programmatic access, ensure your client application includes the `Authorization: Basic ` header in all API requests.