Package org.apache.camel.component.kafka.security

Class KafkaSecurityConfigurer

java.lang.Object
org.apache.camel.component.kafka.security.KafkaSecurityConfigurer
public class KafkaSecurityConfigurer extends Object
Builder for Kafka security configuration.

This class simplifies the creation of JAAS configurations and security settings for various Kafka authentication mechanisms. Instead of manually constructing complex JAAS configuration strings, users can use this builder with simple method calls.

Usage examples: 

 // SCRAM-SHA-512 authentication
 KafkaSecurityConfigurer.forAuthType(KafkaAuthType.SCRAM_SHA_512)
         .withCredentials("username", "password")
         .configure(kafkaConfiguration);

 // Using convenience methods
 KafkaSecurityConfigurer.scramSha512("username", "password")
         .configure(kafkaConfiguration);

 // OAuth 2.0 authentication
 KafkaSecurityConfigurer.forAuthType(KafkaAuthType.OAUTH)
         .withOAuth("clientId", "clientSecret", "https://auth.example.com/token")
         .configure(kafkaConfiguration);

 // AWS MSK IAM authentication
 KafkaSecurityConfigurer.awsMskIam()
         .configure(kafkaConfiguration);

 // Getting properties directly (for non-Camel usage)
 Properties props = KafkaSecurityConfigurer.scramSha512("user", "pass").toProperties();

This class is designed to be backward compatible with existing security configurations. If you prefer to use the traditional approach with explicit securityProtocol, saslMechanism, and saslJaasConfig properties, those will continue to work as before.

  • Method Details

    • forAuthType

      public static KafkaSecurityConfigurer forAuthType(KafkaAuthType authType)
      Creates a new security configurer for the specified authentication type.
      Parameters:
      authType - the authentication type to use
      Returns:
      a new KafkaSecurityConfigurer instance

    • noAuth

      public static KafkaSecurityConfigurer noAuth()
      Creates a new security configurer for no authentication.
      Returns:
      a new KafkaSecurityConfigurer instance configured for no authentication

    • plain

      public static KafkaSecurityConfigurer plain(String username, String password)
      Creates a new security configurer for PLAIN authentication.
      Parameters:
      username - the SASL username
      password - the SASL password
      Returns:
      a new KafkaSecurityConfigurer instance configured for PLAIN authentication

    • scramSha512

      public static KafkaSecurityConfigurer scramSha512(String username, String password)
      Creates a new security configurer for SCRAM-SHA-512 authentication.
      Parameters:
      username - the SASL username
      password - the SASL password
      Returns:
      a new KafkaSecurityConfigurer instance configured for SCRAM-SHA-512 authentication

    • scramSha256

      public static KafkaSecurityConfigurer scramSha256(String username, String password)
      Creates a new security configurer for SCRAM-SHA-256 authentication.
      Parameters:
      username - the SASL username
      password - the SASL password
      Returns:
      a new KafkaSecurityConfigurer instance configured for SCRAM-SHA-256 authentication

    • ssl

      public static KafkaSecurityConfigurer ssl()
      Creates a new security configurer for SSL/mTLS authentication.
      Returns:
      a new KafkaSecurityConfigurer instance configured for SSL authentication

    • awsMskIam

      public static KafkaSecurityConfigurer awsMskIam()
      Creates a new security configurer for AWS MSK IAM authentication.
      Returns:
      a new KafkaSecurityConfigurer instance configured for AWS MSK IAM authentication

    • oauth

      public static KafkaSecurityConfigurer oauth(String clientId, String clientSecret, String tokenEndpointUri)
      Creates a new security configurer for OAuth 2.0 authentication.
      Parameters:
      clientId - the OAuth client ID
      clientSecret - the OAuth client secret
      tokenEndpointUri - the OAuth token endpoint URI
      Returns:
      a new KafkaSecurityConfigurer instance configured for OAuth authentication

    • kerberos

      public static KafkaSecurityConfigurer kerberos(String principal, String keytab)
      Creates a new security configurer for Kerberos authentication.
      Parameters:
      principal - the Kerberos principal
      keytab - the path to the Kerberos keytab file
      Returns:
      a new KafkaSecurityConfigurer instance configured for Kerberos authentication

    • withCredentials

      public KafkaSecurityConfigurer withCredentials(String username, String password)
      Sets username and password credentials.
      Parameters:
      username - the SASL username
      password - the SASL password
      Returns:
      this configurer instance for method chaining

    • withSsl

      public KafkaSecurityConfigurer withSsl(boolean useSsl)
      Enables or disables SSL encryption.

      For SASL authentication types, this controls whether to use SASL_SSL (default) or SASL_PLAINTEXT. For no authentication (NONE), this controls whether to use SSL or PLAINTEXT.

      Parameters:
      useSsl - true to use SSL encryption (default), false for plaintext
      Returns:
      this configurer instance for method chaining

    • withOAuth

      public KafkaSecurityConfigurer withOAuth(String clientId, String clientSecret, String tokenEndpointUri)
      Configures OAuth 2.0 authentication parameters.
      Parameters:
      clientId - the OAuth client ID
      clientSecret - the OAuth client secret
      tokenEndpointUri - the OAuth token endpoint URI
      Returns:
      this configurer instance for method chaining

    • withOAuthScope

      public KafkaSecurityConfigurer withOAuthScope(String scope)
      Sets the OAuth scope.
      Parameters:
      scope - the OAuth scope
      Returns:
      this configurer instance for method chaining

    • withKerberos

      public KafkaSecurityConfigurer withKerberos(String principal, String keytab)
      Configures Kerberos authentication parameters.
      Parameters:
      principal - the Kerberos principal
      keytab - the path to the Kerberos keytab file
      Returns:
      this configurer instance for method chaining

    • withKerberosUseKeyTab

      public KafkaSecurityConfigurer withKerberosUseKeyTab(boolean useKeyTab)
      Sets whether to use keytab for Kerberos authentication.
      Parameters:
      useKeyTab - true to use keytab (default), false otherwise
      Returns:
      this configurer instance for method chaining

    • withKerberosStoreKey

      public KafkaSecurityConfigurer withKerberosStoreKey(boolean storeKey)
      Sets whether to store the Kerberos key.
      Parameters:
      storeKey - true to store the key (default), false otherwise
      Returns:
      this configurer instance for method chaining

    • withCustomJaasConfig

      public KafkaSecurityConfigurer withCustomJaasConfig(String jaasConfig)
      Sets a custom JAAS configuration string.

      This overrides the auto-generated JAAS configuration. Use this for advanced use cases not covered by the standard authentication types.

      Parameters:
      jaasConfig - the custom JAAS configuration string
      Returns:
      this configurer instance for method chaining

    • getAuthType

      public KafkaAuthType getAuthType()
      Returns the authentication type.
      Returns:
      the authentication type

    • buildJaasConfig

      public String buildJaasConfig()
      Builds the JAAS configuration string based on the authentication type and configured parameters.
      Returns:
      the JAAS configuration string, or null if not applicable
      Throws:
      IllegalArgumentException - if required parameters are missing for the authentication type

    • getSecurityProtocol

      public String getSecurityProtocol()
      Returns the appropriate security protocol based on the authentication type and SSL setting.
      Returns:
      the security protocol (e.g., "SASL_SSL", "SSL", "PLAINTEXT", "SASL_PLAINTEXT")

    • getSaslMechanism

      public String getSaslMechanism()
      Returns the SASL mechanism for this authentication type.
      Returns:
      the SASL mechanism, or null if not a SASL auth type

    • configure

      public void configure(KafkaConfiguration configuration)
      Applies this security configuration to a KafkaConfiguration instance.

      This method sets the securityProtocol, saslMechanism, and saslJaasConfig properties on the provided configuration object.

      Parameters:
      configuration - the KafkaConfiguration to configure

    • toProperties

      public Properties toProperties()
      Creates a Properties object with security settings.

      This is useful for direct Kafka client usage or other non-Camel scenarios.

      Returns:
      a Properties object containing the security configuration

    • validate

      public void validate()
      Validates that required properties are set based on the authentication type.
      Throws:
      IllegalArgumentException - if required properties are missing

    • toString

      public String toString()
      Overrides:
      toString in class Object