KIP-86 — Configurable SASL callback handlers

Accepted Kafka 2.0 Security

Introduces pluggable SASL callback handlers for both client and server sides, decoupling credential verification logic from the SASL mechanism implementation via configurable sasl.server.callback.handler.class and sasl.client.callback.handler.class. Kafka's built-in SASL/PLAIN and SASL/SCRAM handlers hard-coded credential lookups (JAAS config or ZooKeeper), making it impossible to integrate alternative credential stores without replacing the entire SaslServer.

Details