SASL
The framework Kafka uses to authenticate clients with a choice of login mechanisms.
The sasl.mechanism setting picks one: PLAIN, SCRAM, GSSAPI for Kerberos or OAUTHBEARER. SASL proves who the client is; TLS underneath it encrypts the connection.