To configure SASL-based SCRAM-SHA-256 authentication, set the `type` property to `scram-sha-256`.
The SCRAM-SHA-256 authentication mechanism requires a username and password.

=== `username`
Specify the username in the `username` property.

=== `passwordSecret`
In the `passwordSecret` property, specify a link to a `Secret` containing the password.

You can use the secrets created by the User Operator.

If required, you can create a text file that contains the password, in cleartext, to use for authentication:

[source,shell,subs="+quotes"]
echo -n _PASSWORD_ > _MY-PASSWORD_.txt

You can then create a `Secret` from the text file, setting your own field name (key) for the password:

[source,shell,subs="+quotes"]
kubectl create secret generic _MY-CONNECT-SECRET-NAME_ --from-file=_MY-PASSWORD-FIELD-NAME_=./_MY-PASSWORD_.txt

.Example Secret for SCRAM-SHA-256 client authentication for Kafka Connect
[source,yaml,subs="attributes+"]
----
apiVersion: v1
kind: Secret
metadata:
  name: my-connect-secret-name
type: Opaque
data:
  my-connect-password-field: LFTIyFRFlMmU2N2Tm
----

The `secretName` property contains the name of the `Secret`, and the `password` property contains the name of the key under which the password is stored inside the `Secret`.

IMPORTANT: Do not specify the actual password in the `password` property.

.Example SASL-based SCRAM-SHA-256 client authentication configuration for Kafka Connect
[source,yaml,subs=attributes+]
----
authentication:
  type: scram-sha-256
  username: my-connect-username
  passwordSecret:
    secretName: my-connect-secret-name
    password: my-connect-password-field
----
