# Docker schema-registry config for acl
**URL:** https://forum.confluent.io/t/docker-schema-registry-config-for-acl/7541
**Category:** Schema Registry
**Created:** [31 March 2023 04:27 UTC](https://forum.confluent.io/t/docker-schema-registry-config-for-acl/7541 "2023-03-31T04:27:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sevenouts](https://forum.confluent.io/u/sevenouts)
#### Post date: [31 March 2023 04:27 UTC](https://forum.confluent.io/t/docker-schema-registry-config-for-acl/7541/1 "2023-03-31T04:27:40Z")
I’m trying to use ACL for schema registry. The requirements say i must have some form of authentication in place. So i decided to use HTTP basic authentication. When i look at its documentation:
> [https://docs.confluent.io/platform/current/security/basic-auth.html](https://docs.confluent.io/platform/current/security/basic-auth.html)
It says i have to do this setting:
> export SCHEMA\_REGISTRY\_OPTS=-Djava.security.auth.login.config=/path/to/the/jaas\_config.conf
> (path-to-confluent)/bin/schema-registry-start (path-to-confluent)/etc/schema-registry/schema-registry.properties
The problem is i don’t use confluent, how do i replace this directory?
> (path-to-confluent)/bin/schema-registry-start
This is my current docker compose:
> services:
> schema-registry:
> image: confluentinc/cp-schema-registry:5.4.1
> hostname: schema-registry
> depends\_on:
> - kafka-broker-1
> - kafka-broker-2
> - kafka-broker-3
> ports:
> - “8081:8081”
> environment:
> SCHEMA\_REGISTRY\_HOST\_NAME: schema-registry
> SCHEMA\_REGISTRY\_KAFKASTORE\_CONNECTION\_URL: ‘zookeeper:2181’
> SCHEMA\_REGISTRY\_LISTENERS: [http://schema-registry:8081](http://schema-registry:8081)
> SCHEMA\_REGISTRY\_KAFKASTORE\_BOOTSTRAP\_SERVERS: EXTERNAL://kafka-broker-2:9092,INTERNAL://localhost:29093,PLAINTEXT://kafka-broker-2:9292
> SCHEMA\_REGISTRY\_DEBUG: ‘true’
> SCHEMA\_REGISTRY\_CONFLUENT\_SCHEMA\_REGISTRY\_AUTHORIZER\_CLASS: io.confluent.kafka.schemaregistry.security.authorizer.schemaregistryacl.SchemaRegistryAclAuthorizer
> SCHEMA\_REGISTRY\_SCHEMA\_REGISTRY\_RESOURCE\_EXTENSION\_CLASS: io.confluent.kafka.schemaregistry.security.SchemaRegistrySecurityResourceExtension
> SCHEMA\_REGISTRY\_AUTHENTICATION\_METHOD: BASIC
> SCHEMA\_REGISTRY\_AUTHENTICATION\_ROLES: admin
> SCHEMA\_REGISTRY\_OPTS: ‘-Djava.security.auth.login.config=/opt/security/schema-registry.jaas /bin/schema-registry-start /etc/schema-registry/schema-registry.properties’
> volumes:
> - “./volumes/jaas:/opt/security”
> networks:
> - ${GLOBAL\_NETWORK:-kafka}
---
### Author:  [@dtroiano](https://forum.confluent.io/u/dtroiano)
#### Post date: [31 March 2023 13:54 UTC](https://forum.confluent.io/t/docker-schema-registry-config-for-acl/7541/2 "2023-03-31T13:54:54Z")
Hi @sevenouts,
There are two lines in the docs (one to export the environment variable and the next to start Schema Registry) – you just need up to the first whitespace in the Docker Compose file:
```plaintext
SCHEMA_REGISTRY_OPTS: '-Djava.security.auth.login.config=/opt/security/schema-registry.jaas'
```
HTH,
Dave
---
### Author:  [@sevenouts](https://forum.confluent.io/u/sevenouts)
#### Post date: [4 April 2023 05:14 UTC](https://forum.confluent.io/t/docker-schema-registry-config-for-acl/7541/5 "2023-04-04T05:14:14Z")
According to the example `jaas_config.conf` is:
```auto
SchemaRegistry-Props {
org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
file="/path/to/password-file"
debug="false";
};
```
What extension does this password-file use? Is it .properties or .jaas or .conf what?
Can i replace this
> org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
With this?
> org.apache.kafka.common.security.plain.PlainLoginModule required