https://connect.hyland.com/t5/nuxeo-forum/kafka-with-sasl-ssl/m-p/314269#M1270 <P>Nuxeo folks. In kafka-config.xml.nxftl, the following version supports SASL plaintext, SASL SCRAM-SHA-512, SASL SCRAM-SHA-512 over SSL, and two-way SSL. Please consider:</P> <PRE><CODE>&lt;#escape x as x?xml&gt; &lt;?xml version="1.0"?&gt; &lt;component name="org.nuxeo.kafka.defaultConfig"&gt; &lt;#if "${kafka.enabled}" == "true"&gt; &lt;require&gt;org.nuxeo.runtime.stream.kafka.service&lt;/require&gt; &lt;extension point="kafkaConfig" target="org.nuxeo.runtime.stream.kafka.service"&gt; &lt;kafkaConfig name="default" topicPrefix="${kafka.topicPrefix}"&gt; &lt;producer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="default.replication.factor"&gt;${kafka.default.replication.factor}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/producer&gt; &lt;consumer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="request.timeout.ms"&gt;${kafka.request.timeout.ms}&lt;/property&gt; &lt;property name="max.poll.interval.ms"&gt;${kafka.max.poll.interval.ms}&lt;/property&gt; &lt;property name="session.timeout.ms"&gt;${kafka.session.timeout.ms}&lt;/property&gt; &lt;property name="heartbeat.interval.ms"&gt;${kafka.heartbeat.interval.ms}&lt;/property&gt; &lt;property name="max.poll.records"&gt;${kafka.max.poll.records}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/consumer&gt; &lt;/kafkaConfig&gt; &lt;kafkaConfig name="bulk" topicPrefix="${kafka.topicPrefix}bulk-"&gt; &lt;producer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="default.replication.factor"&gt;${kafka.default.replication.factor}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/producer&gt; &lt;consumer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="request.timeout.ms"&gt;${kafka.request.timeout.ms}&lt;/property&gt; &lt;property name="max.poll.interval.ms"&gt;${kafka.max.poll.interval.ms}&lt;/property&gt; &lt;property name="session.timeout.ms"&gt;${kafka.session.timeout.ms}&lt;/property&gt; &lt;property name="heartbeat.interval.ms"&gt;${kafka.heartbeat.interval.ms}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/consumer&gt; &lt;/kafkaConfig&gt; &lt;/extension&gt; &lt;/#if&gt; &lt;/component&gt; &lt;/#escape&gt; </CODE></PRE> Mon, 29 Apr 2019 12:34:05 GMT Eric_Ace 2019-04-29T12:34:05Z https://connect.hyland.com/t5/nuxeo-forum/kafka-with-sasl-ssl/m-p/314269#M1270 <P>Nuxeo folks. In kafka-config.xml.nxftl, the following version supports SASL plaintext, SASL SCRAM-SHA-512, SASL SCRAM-SHA-512 over SSL, and two-way SSL. Please consider:</P> <PRE><CODE>&lt;#escape x as x?xml&gt; &lt;?xml version="1.0"?&gt; &lt;component name="org.nuxeo.kafka.defaultConfig"&gt; &lt;#if "${kafka.enabled}" == "true"&gt; &lt;require&gt;org.nuxeo.runtime.stream.kafka.service&lt;/require&gt; &lt;extension point="kafkaConfig" target="org.nuxeo.runtime.stream.kafka.service"&gt; &lt;kafkaConfig name="default" topicPrefix="${kafka.topicPrefix}"&gt; &lt;producer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="default.replication.factor"&gt;${kafka.default.replication.factor}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/producer&gt; &lt;consumer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="request.timeout.ms"&gt;${kafka.request.timeout.ms}&lt;/property&gt; &lt;property name="max.poll.interval.ms"&gt;${kafka.max.poll.interval.ms}&lt;/property&gt; &lt;property name="session.timeout.ms"&gt;${kafka.session.timeout.ms}&lt;/property&gt; &lt;property name="heartbeat.interval.ms"&gt;${kafka.heartbeat.interval.ms}&lt;/property&gt; &lt;property name="max.poll.records"&gt;${kafka.max.poll.records}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/consumer&gt; &lt;/kafkaConfig&gt; &lt;kafkaConfig name="bulk" topicPrefix="${kafka.topicPrefix}bulk-"&gt; &lt;producer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="default.replication.factor"&gt;${kafka.default.replication.factor}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/producer&gt; &lt;consumer&gt; &lt;property name="bootstrap.servers"&gt;${kafka.bootstrap.servers}&lt;/property&gt; &lt;property name="request.timeout.ms"&gt;${kafka.request.timeout.ms}&lt;/property&gt; &lt;property name="max.poll.interval.ms"&gt;${kafka.max.poll.interval.ms}&lt;/property&gt; &lt;property name="session.timeout.ms"&gt;${kafka.session.timeout.ms}&lt;/property&gt; &lt;property name="heartbeat.interval.ms"&gt;${kafka.heartbeat.interval.ms}&lt;/property&gt; &lt;#if ((kafka.sasl.enabled)!"false") == "true" || ((kafka.ssl)!"false") == "true"&gt; &lt;property name="security.protocol"&gt;${kafka.security.protocol}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.sasl.enabled}" == "true"&gt; &lt;property name="sasl.mechanism"&gt;${kafka.sasl.mechanism}&lt;/property&gt; &lt;property name="sasl.jaas.config"&gt;${kafka.sasl.jaas.config}&lt;/property&gt; &lt;/#if&gt; &lt;#if "${kafka.ssl}" == "true"&gt; &lt;property name="ssl.truststore.type"&gt;${kafka.truststore.type}&lt;/property&gt; &lt;property name="ssl.truststore.location"&gt;${kafka.truststore.path}&lt;/property&gt; &lt;property name="ssl.truststore.password"&gt;${kafka.truststore.password}&lt;/property&gt; &lt;#if ((kafka.security.protocol)!"") == "SSL"&gt; &lt;property name="ssl.keystore.type"&gt;${kafka.keystore.type}&lt;/property&gt; &lt;property name="ssl.keystore.location"&gt;${kafka.keystore.path}&lt;/property&gt; &lt;property name="ssl.keystore.password"&gt;${kafka.keystore.password}&lt;/property&gt; &lt;/#if&gt; &lt;/#if&gt; &lt;/consumer&gt; &lt;/kafkaConfig&gt; &lt;/extension&gt; &lt;/#if&gt; &lt;/component&gt; &lt;/#escape&gt; </CODE></PRE> Mon, 29 Apr 2019 12:34:05 GMT https://connect.hyland.com/t5/nuxeo-forum/kafka-with-sasl-ssl/m-p/314269#M1270 Eric_Ace 2019-04-29T12:34:05Z