Skip to main content
Quick navigation

Enterprise Security

This page covers the Enterprise level security available the Enterprise version of Conduktor Gateway.

Refer to Open Source Security for open source security documentation.

Securing client access to Gateway

Jump to:

Access control

Conduktor Gateway supports SASL authentication with clients the same as base Kafka. The PLAIN SASL mechanism is used to communicate user information to the server via the usual username and password fields.

The gateway uses encrypted JWT tokens in the password field to encode metadata required by the gateway (tenant information etc.).

To configure access control first we must enable JWT based authentication. This can be done with the following environment variables:

USER_POOL_CLASSNAME: io.conduktor.proxy.service.userPool.JwtUserPoolService

We then configure the shared secret that will encrypt the JWT tokens.

      USER_POOL_SECRET_KEY: secret

Generating tokens

Tokens are generated using an admin REST API. This is not exposed by default and is secured with a set of administrator credentials that are also configured with environment variables. This interface can be enabled by setting the following:


Conduktor Gateway is natively multi-tenant. This means that tokens must contain more than a username and secret, they must also encode tenant metadata. For convenience a token can be generated through the API by providing the following:

  1. An organisation id - an integer valuing indicating the tenant's organisation
  2. A cluster id - some tenants may have multiple clusters, this is a further string identifier to differentiate these.
  3. A user id

Note: A tenant name in Conduktor Gateway is formed of [organisation id]-[cluster id]

curl \
--silent \
--request POST conduktor-proxy:8888/auth/tenant/[organisation id]-[cluster id]/user/[user id]/token \
--data-raw \{\"username\":\"[master username]\",\"password\":\"[master password]\"\}'

This will respond with a token similar to this:

"data" : "eyJhbGciOiJIUzI1NiJ9.eyJvcmdJZCI6MSwiY2x1c3RlcklkIjoiY2x1c3RlcjEiLCJ1c2VybmFtZSI6InRlc3RAY29uZHVrdG9yLmlvIn0.XhB1e_ZXvgZ8zIfr28UQ33S8VA7yfWyfdM561Em9lrM"

Using the token

The token should be provided in the password field of the client configuration as follows:

sasl.mechanism=PLAIN required username="" password="eyJhbGciOiJIUzI1NiJ9.eyJvcmdJZCI6MSwiY2x1c3RlcklkIjoiY2x1c3RlcjEiLCJ1c2VybmFtZSI6InRlc3RAY29uZHVrdG9yLmlvIn0.XhB1e_ZXvgZ8zIfr28UQ33S8VA7yfWyfdM561Em9lrM";