kafka authentication methods

[iwpnd]

Hi! 👋

in #615 we added authentication with SASL and shortly after the release I noticed that we did take care of the authentication but forgot about SSL in the process. As a result SASL authentication currently does only work if the connection to the broker is not encrypted (SASL PLAIN). This is because Tile38 does not allow for the verification to be skipped in the sarama config.

I created an example for the case at iwpnd/tile-kafka-sasl and tested SASL auth without SSL successfully.

Now with this PR I want to fix this introducing a new auth flow to support TLS, SASL, SASL/SSL and no-auth as follows:

SASL PLAIN
?auth=sasl&sha512=true is using using credentials from the env KAFKA_PASSWORD / KAFKA_USERNAME

SASL/SSL
?auth=sasl&ssl=true&sha512=true&cacert=/path/to/cert is is using using credentials from the env KAFKA_PASSWORD / KAFKA_USERNAME. This now also validates the given root certificate accordingly.

TLS
?auth=tls&cacert=/path/to/cacert&cert=/path/to/user.crt&key=/path/to/user.key works as it had before #615. As TLS authenfication requires SSL, the additional ssl=true is obsolete and will be ignored.

Additional authentication methods can now be added as they're needed (SASL GSSAPI, PLAIN).

SASL/SSL has now been tested in a production environment with this fork iwpnd/ben38 successfully.

What do you think?

[tidwall]

LGTM

[iwpnd]

Hey @tidwall, when do you plan on releasing the next version?

[tidwall]

The target is early this week.

[tidwall]

Just released !!!