...

1. support authentication of client (i.e. consumer & producer) connections to brokers
2. support authorization of the assorted operations that can take place over those connections
3. support encrypting those connections
4. support security principals representing interactive users, user groups, and long-running services
5. security should be optional; installations that don't want the above features shouldn't have to pay for them
6. preserve backward compatibility; in particular, extant third-party clients should still work

Current implementation efforts are tracked in KAFKA-1682.

Features In Scope

• Authentication via SSL & Kerberos through SASL
• Auditing
• Authorization through Unix-like users, permissions and ACLs
• Encryption over the wire (optional)
• It should be easy to enforce the use of security at a given site

...