[question] Can the kafka-proxy forward client's auth to broker?

[dao-jun]

If the broker enables auth, and the clients configured correctly, can the proxy forward client's auth param to broker and make it works?

[alexz0nder]

Hello,
I'd also like to know how to configure this version of kafka-proxy, to:

• authenticate clients in kafka brokers with SASL PLAIN
• but to use SSL for secure connection.

For now, we use the kafkaproxy project to pass external clients to our kafka cluster.
And it works. Which means:

• it authenticates clients on kafka brokers,
• it passes through SSL connection with SASL PLAIN auth.
  But it halts periodically. :(

This is why we're looking forward to switching to this project.
But, unfortunately, I haven't found the example of arguments to start this kafka-proxy to achieve needed authentication.

[dao-jun]

@alexz0nder you can try this

[alexz0nder]

Thank you for your reply, but I have tried particularly that kind of config.

`
#systemctl cat kafka-proxy
...
ExecStart=/opt/kafka-proxy/bin/kafka-proxy server
--bootstrap-server-mapping="kafka-server01:9095,0.0.0.0:9092"
--bootstrap-server-mapping="kafka-server02:9095,0.0.0.0:9093"
--bootstrap-server-mapping="kafka-server03:9095,0.0.0.0:9094"
--dynamic-listeners-disable
--http-disable
--tls-enable
--tls-ca-chain-cert-file=/opt/kafka-proxy/ssl/truststore.pem
--tls-client-cert-file=/opt/kafka-proxy/ssl/proxy.crt
--tls-client-key-file=/opt/kafka-proxy/ssl/proxy.key
--sasl-enable
--sasl-method=PLAIN
--security.protocol=SASL_SSL"
--log-format=json
--log-level ${KAFKAPROXY_LOG_LEVEL}
--sasl-jaas-config-file=/etc/kafka-proxy/jaas.config &> /opt/kafka-proxy/log/kafka-proxy.log
...

cat /etc/kafka-proxy/jaas.config

KafkaClient {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="proxy"
password="password";
};
`

And had have the log like:
{"@level":"info","@message":"New connection for kafka-server03:9095","@timestamp":"2025-11-27T08:57:15+05:00"} {"@level":"debug","@message":"Sending SaslHandshakeRequest mechanism: PLAIN version: 0","@timestamp":"2025-11-27T08:57:15+05:00"} {"@level":"debug","@message":"Successful SASL handshake. Available mechanisms: [PLAIN]","@timestamp":"2025-11-27T08:57:15+05:00"} {"@level":"debug","@message":"Sending authentication opaque packets, mechanism PLAIN","@timestamp":"2025-11-27T08:57:15+05:00"} {"@level":"debug","@message":"Kafka request key -4095, version 1, length 369296129","@timestamp":"2025-11-27T08:57:15+05:00"} {"@level":"info","@message":"Reading data from local connection on kafka-proxy01:9094 from 10.10.10.10:54822 (10.104.12.5:9095) had error: api key -4095 is invalid, possible cause: using plain connection instead of TLS","@timestamp":"2025-11-27T08:57:15+05:00"}

So I already have googled this error and found one issue on this project in which mentioned the same error, but the topicstarter have fixed it by his self with no explain :(

For now just building a testing stand to try different "--proxy-listener-" arguments which might help, I suppose... But not sure :)