From 882dbe0063d68fe37cdc595b3c87b1c82bfb22d8 Mon Sep 17 00:00:00 2001 From: Bryan Sanchez Date: Thu, 22 Oct 2026 14:40:07 +0200 Subject: [PATCH] Update Kafka producer settings for Azure compatibility with SASL_SSL --- samples/eventhubs/python/README.md | 2 -- .../eventhubs/python/src/producers/producer_kafka.py | 11 +++++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/samples/eventhubs/python/README.md b/samples/eventhubs/python/README.md index 7e40453..56494d4 100644 --- a/samples/eventhubs/python/README.md +++ b/samples/eventhubs/python/README.md @@ -207,8 +207,6 @@ bash scripts/cleanup.sh ## Emulator notes -- Kafka is served in plaintext by the emulator; Azure requires `SASL_SSL`. The producer - shows the SASL settings needed against Azure in a comment. - Data-plane authorization is existence-checked by the emulator, so the send-only and listen-only rules demonstrate the *deployment* pattern rather than an enforced boundary. Both rules are used exactly as they would be against Azure. diff --git a/samples/eventhubs/python/src/producers/producer_kafka.py b/samples/eventhubs/python/src/producers/producer_kafka.py index d0c537c..d8e68c0 100644 --- a/samples/eventhubs/python/src/producers/producer_kafka.py +++ b/samples/eventhubs/python/src/producers/producer_kafka.py @@ -39,13 +39,16 @@ def main() -> None: hub = event_hub_name() bootstrap = namespace_endpoint(conn_str) - # Topic == event hub. Against Azure you would add security.protocol=SASL_SSL, - # sasl.mechanism=PLAIN, sasl.username='$ConnectionString' (the literal string - Azure - # expects it verbatim) and the full connection string as sasl.password; the emulator - # serves Kafka in plaintext (a documented deviation). + # Topic == event hub. These are the settings Azure requires for Kafka clients, used + # unchanged against LocalStack: sasl.username is the literal string '$ConnectionString' + # and the full connection string is the password. producer = Producer( { "bootstrap.servers": bootstrap, + "security.protocol": "SASL_SSL", + "sasl.mechanism": "PLAIN", + "sasl.username": "$ConnectionString", + "sasl.password": conn_str, "client.id": "legacy-settlement-gateway", "message.timeout.ms": 20000, # Broker metadata advertises a hostname; pinning the client to IPv4 avoids a