Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload

This post details the operational differences between SASL PLAIN (using PlainLoginModule and FileBasedLoginModule) and SASL SCRAM (using ScramLoginModule) in Kafka regarding credential management and hot-reloading. It explains that PlainLoginModule with static JAAS requires broker restarts for credential changes, while ScramLoginModule (leveraging cluster metadata) and FileBasedLoginModule (watching a credential file) support hot-reloading. It provides a concrete example with three listeners and practical recommendations, emphasizing SCRAM for its security and native hot-reload capabilities.