How to configure MirrorMaker2 for SCRAM-SHA-256 authenticated source cluster

[cy-ddg]

Hello,

I want to user MirrorMaker2 to copy over all events for a given topic from an external Kafka instance. This instance is not under my control and I don't have any possibility to change its configuration.

It is using SASL with SCRAM-SHA-256 for authentication. According to the documentation I can only create a MirrorMaker2 instance using SCRAM-SHA-512. Is there any way to use the MirrorMaker2 provided by Strimzi to achieve this goal?

Thanks!

[scholzj]

I'm afraid we do not support SCRAM-SHA-256. Only 512.

[scholzj]

Would you add it just to the clients such a MirrorMaker, Bridge, Connect, etc.? I think that would be fairly easy. The only tricky thing might be testing it I guess. So I think such contribution should not be a problem.

Adding support for it to Strimzi based Kafka brokers would be a bit more tricky since it would also involve the user operator etc. That might require a bigger discussion.

[cy-ddg]

For our use case adding it to the clients would be enough. I also don't see a need to add it to the Kafka brokers as you would just be able to use SCRAM-SHA-512 there instead.

[scholzj]

Yeah, ok. Then that should not be a problem. I don't think there is a way to test it easily - the other authentication mechanisms test against Strimzi. But this one cannot if the Strimzi brokers don't support it. Nut maybe we can live without the test for it. At the end it would be more or less the same as SHA-512 which will be covered.

[cy-ddg]

Awesome! So the next step would probably be to open a corresponding issue and reference that from a pull request?

[scholzj]

Yeah, you can open an enhancement issue. Or if you want you can also just open a PR directly.

[Neustradamus]

It has been added by @abaus-vc:

• Added SCRAM-SHA-256 authentication for Kafka clients #5909