KIP-368 — KIP 368: Allow SASL Connections to Periodically Re-Authenticate

Accepted Kafka 2.2 Security

Adds support for periodic SASL re-authentication on existing connections by introducing a `connections.max.reauth.ms` broker configuration, after which the client must re-authenticate before the next request or the connection is closed. Long-lived Kafka connections bypass token expiry for SASL/OAUTHBEARER and prevent immediate revocation of access when SASL/SCRAM credentials are rotated or ACLs are changed.

Protocol Impact

SaslHandshake · SaslAuthenticate

Details