Folks - regarding kafka-config.xml.nxftl: Presently, SASL is only enabled if SSL is enabled. (The sasl if directive is enclosed in the ssl if directive.) In a local server testing environment, it might be beneficial to configure Kafka for SASL PLAINTEXT (or SCRAM_SHA_nnn) -- to simplify the configuration for development and testing. (In fact, that's what I had tried.) But as kafka-config.xml.nxftl is presently structured, this isn't possible without supplying a custom contrib. If the if/else statements in the nxftl were structured such that SASL and SSL were independent of one another, then SASL/PLAINTEXT (or SCRAM_SHA_nnn) could be tested without SSL just using nuxeo.conf settings.