Skip to main content
Conduktor provides flexible authentication and authorization for Kafka clients, allowing you to choose where and how clients are authenticated and what permissions they have.

​
Two authentication modes

Gateway offers two distinct modes for managing client authentication and authorization: Gateway-managed mode
  • Gateway handles all authentication and authorization
  • and defined in Gateway
  • Supports both local and external service accounts
  • Local service accounts authenticate with PLAIN (token) or, with the service accounts feature flag enabled, SCRAM-SHA-512 / SCRAM-SHA-256 credentials managed by Gateway
  • Full control over client access without touching Kafka configuration
  • Enables and other Gateway-specific features
  • Enables efficient connection pooling (GATEWAY_UPSTREAM_CONNECTION_POOL_TYPE=ROUND_ROBIN) to multiplex client connections onto a small pool of connections per broker, cutting connection overhead on Kafka as the number of clients grows
Kafka-managed mode
  • Authentication and authorization delegated to the backing Kafka cluster
  • Existing Kafka service accounts and ACLs continue to work
  • Useful for gradual migration to Gateway
  • External service accounts can still be mapped for friendly names in Gateway
  • Virtual resources (Virtual Clusters, alias topics) not available
  • Connection pooling not available (each client authenticates on its own connection)

​
Key decisions

When configuring Gateway authentication, you need to decide:
  • Where to authenticate: at Gateway or delegate to Kafka
  • Authentication method: SASL (PLAIN, SCRAM, OAUTHBEARER), mTLS, or anonymous
  • Service account type: local (Gateway-managed) or external (identity provider)
  • Authorization location: Gateway ACLs or Kafka ACLs

​
Benefits

  • Gradual adoption: start with Kafka-managed mode and migrate to Gateway-managed
  • Unified access control: manage authentication across multiple clusters from one place
  • Flexible identity integration: work with existing identity providers or use Gateway’s built-in authentication
  • Enhanced security: add Gateway policies and without changing Kafka security