Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 91. KafkaClientAuthenticationCustom schema reference

Used in: KafkaBridgeSpec, KafkaConnectSpec, KafkaMirrorMaker2ClusterSpec

Full list of KafkaClientAuthenticationCustom schema properties

To configure custom client authentication, set the type property to custom. Custom client authentication allows you to use any type of Kafka-supported authentication mechanism. This authentication option is especially useful with third-party Apache Kafka services, such as Amazon MSK, that require their own authentication mechanisms.

Example custom client authentication configuration using the AWS_MSK_IAM authentication

  authentication:
    type: custom
    sasl: true
    config:
      sasl.mechanism: AWS_MSK_IAM
      sasl.jaas.config: software.amazon.msk.auth.iam.IAMLoginModule required;
      sasl.client.callback.handler.class: software.amazon.msk.auth.iam.IAMClientCallbackHandler

The config section accepts only options that start with the prefixes sasl. and ssl.keystore.. All other options are ignored. To configure additional options, use the related properties of the Streams for Apache Kafka custom resource, such as .spec.config or .spec.tls. The security.protocol `setting is generated automatically from the `sasl property (when you use custom authentication) and the tls configuration in the same Streams for Apache Kafka custom resource:

  • SASL = True, TLS = True SASL_SSL
  • SASL = False, TLS = True SSL
  • SASL = True, TLS = False SASL_PLAINTEXT
  • SASL = False, TLS = False PLAINTEXT

91.1. Using secrets in custom authentication
Copy link

If your custom authentication mechanism requires additional information from Secret or ConfigMap resources, use the Additional Volumes feature to mount them into the operands. Kafka configuration providers can be used to load them from the disk.

91.2. Using additional authentication plugins
Copy link

Custom authentication mechanisms might require additional plugins for the operand. You can add them using the Additional Volumes feature. Alternatively, you can build a custom container image.

The type property is a discriminator that distinguishes use of the KafkaClientAuthenticationCustom type from KafkaClientAuthenticationTls, KafkaClientAuthenticationScramSha256, KafkaClientAuthenticationScramSha512, KafkaClientAuthenticationPlain, KafkaClientAuthenticationOAuth. It must have the value custom for the type KafkaClientAuthenticationCustom.

Expand
PropertyProperty typeDescription

type

string

Must be custom.

sasl

boolean

Enable or disable SASL on this authentication mechanism.

config

map

Configuration for the custom authentication mechanism. Only properties with the sasl. and ssl.keystore. prefixes are allowed. Specify other options in the regular configuration section of the custom resource.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top