:_mod-docs-content-type: CONCEPT

To configure SASL-based SCRAM-SHA-512 authentication, set the `type` property to `scram-sha-512`.
The SCRAM-SHA-512 authentication mechanism requires a username and password.

.Example SASL-based SCRAM-SHA-512 client authentication configuration for Kafka Connect
[source,yaml,subs=attributes+]
----
authentication:
  type: scram-sha-512
  username: my-connect-username
  passwordSecret:
    secretName: my-connect-secret-name
    password: my-connect-password-field
----

In the `passwordSecret` property, specify a link to a `Secret` containing the password.

You can use the secrets created by the User Operator.

If required, you can create a text file that contains the password, in cleartext, to use for authentication:

[source,shell,subs="+quotes"]
echo -n <password> > <my_password>.txt

You can then create a `Secret` from the text file, setting your own field name (key) for the password:

[source,shell,subs="+quotes"]
kubectl create secret generic <my-connect-secret-name> --from-file=<my_password_field_name>=./<my_password>.txt

.Example secret for SCRAM-SHA-512 client authentication for Kafka Connect
[source,yaml,subs="attributes+"]
----
apiVersion: v1
kind: Secret
metadata:
  name: my-connect-secret-name
type: Opaque
data:
  my-connect-password-field: LFTIyFRFlMmU2N2Tm
----

The `secretName` property contains the name of the `Secret`, and the `password` property contains the name of the key under which the password is stored inside the `Secret`.

IMPORTANT: Do not specify the actual password in the `password` property.
