A certificate makes the listener require SASL.

Plaintext is the local path. Pass a certificate and a key, and set a username and password, and clients must authenticate before any other call.

Flags and variables

• --tls-cert and --tls-key for the listener certificate.
• CAMUS_SASL_USER and CAMUS_SASL_PASSWORD for the one PLAIN identity.

The mechanism is PLAIN. There is no SCRAM and no delegation token. With a certificate configured, the listener allows ApiVersions and the SASL handshake, and requires SASL before any other API.

Plaintext, on purpose

--dev-plaintext skips TLS. It is refused when the bind address is not loopback, unless you also pass --allow-non-loopback. The Docker image binds 0.0.0.0 and sets that flag, because a container's listener is never the host's loopback. Do not use that combination as a stand-in for SASL on a shared network.

ACLs are a separate switch from the handshake. A client that has authenticated can still be denied a topic. That denial is TOPIC_AUTHORIZATION_FAILED (29), described on the clients page. A resource with no matching ACL is allowed.