...

A configuration option quota.type will be added with supported values "client-id" and "user-principal". This option can be used to choose between the existing client-id based implementation and the new authenticated-principal based implementation.  The default value will be clients client-id to be consistent with Kafka 0.9.0.x and 0.10.0.x.

Default quota configs will apply to authenticated user principals if quota.type=user-principal.

Metrics

If quota.type=usersuser-principal, quota related metrics will be generated for authenticated principals rather than client-ids.

...

kafka-configs.sh will be extended to support authenticated user quotas.  A new entity type “users” will be added which provides quota configuration similar to the existing entity type "clients".

Proposed Changes

...

User Principal 

Authenticated user principal will be obtained from the Session object when quota.type=user-principal. Base64-encoded hex string version of the Principal will be used so that it can be used as a node name in Zookeeper and as the metric name without placing any restrictions on the characters allowed in the principal.   For PLAINTEXT, the principal is "anonymous" by default and quotas will be applied for that principal. But principal can be overridden using a custom principal builder even for PLAINTEXT, enabling different user quotas, for example, for connections from different IP addresses.

Quota Configuration

Quotas are currently configured as the rate limits for producers and consumers based on their client-id. The same set of limits can also will be configured configurable for user principals. If quota.type=user-principal, the configuration specified for authenticated user principals will be used. Default options will applied to either client-id or user principal based on the value of quota.type.

...