title: Adding Basic Auth to Kafka Connect
body: <p>My Kafka cluster is managed by Heroku and is secured via SSL. I can successfully authenticate between the Kafka Connect client and Kafka broker, and I can deploy connectors that also communicate via SSL.</p>
  <p>ELI5: How do I just add username/password or token auth to <em>Connect's REST API</em>??</p>
  <h4>Problem</h4>
  <ol>
  <li>My <code>KAFKA_SECURITY_PROTOCOL</code> is still set to <code>SSL</code>. Does this need to change? Im <strong>not enabling</strong> SASL on the <em>broker</em>, <strong>only the API</strong></li>
  <li>My Dockerfile uses <code>appuser</code>.. is this correct?</li>
  </ol>
  <p>I am trying to add Basic Auth to the Kafka Connect REST API (ex: <code>/connectors</code>). I've followed the steps:</p>
  <ol>
  <li>Add basic auth extension: <code>CONNECT_REST_EXTENSION_CLASSES=&quot;org.apache.kafka.connect.rest.basic.auth.extension.BasicAuthSecurityRestExtension&quot;</code></li>
  <li>Create <code>connect_jaas.conf</code>:</li>
  </ol>
  <pre><code>KafkaConnect {
   org.apache.kafka.connect.rest.basic.auth.extension.PropertyFileLoginModule required
   file=&quot;/app/rest-credentials.properties
  }
  </code></pre>
  <ol start="3">
  <li>Create <code>rest-credentials.properties</code> : <code>appuser=testpassword</code></li>
  <li>Add path to jaas.conf: <code>KAFKA_OPTS=&quot;-Djava.security.auth.login.config=/app&quot;</code></li>
  </ol>
  <h4>Debugging:</h4>
  <p>Output from <code>heroku run bash</code></p>
  <pre><code>bash-4.4$ cat rest-credentials.properties 
  testuser=&lt;redacted password&gt;
  bash-4.4$ cat connect_jaas.conf 
  KafkaConnect {
  org.apache.kafka.connect.rest.basic.auth.extension.PropertyFileLoginModule required
    file=&quot;/app/rest-credentials.properties&quot;
  }
  bash-4.4$ echo $KAFKA_OPTS
  -Djava.security.auth.login.config=/app/connect_jaas.conf
  bash-4.4$ echo $CONNECT_REST_EXTENSION_CLASSES
  org.apache.kafka.connect.rest.basic.auth.extension.BasicAuthSecurityRestExtension
  </code></pre>