Kafka Configs Kafka Protocol Wire Format API Versions KIPs Errors Kafka Upgrade Config Advisor Flink SQL
conduktor.io ↗
KIPs / KIP-48

KIP-48 — Delegation token support for Kafka

Accepted Security

Introduces delegation tokens as lightweight, broker-shared secrets derived from Kerberos TGTs, enabling clients to authenticate without repeated KDC round-trips via a new CreateDelegationToken / RenewDelegationToken / ExpireDelegationToken / DescribeDelegationToken protocol. Kerberos-only setups forced every client to hold a keytab or TGT, creating performance bottlenecks on the KDC, large blast radius on credential compromise, and high operational overhead for distributed processing frameworks.

Protocol Impact

CreateDelegationToken · RenewDelegationToken · ExpireDelegationToken · DescribeDelegationToken

Details

AuthorParth
StatusAccepted
JIRAKAFKA-1696
WikiView on Apache Wiki
Created2016-02-17
Last Modified2018-01-13
Explore how this KIP affects the Kafka protocol in the Protocol Explorer, or see the full KIP database.