kafka kerberos-仅限代理

xuo3flqw  于 2021-06-06  发布在  Kafka
关注(0)|答案(1)|浏览(552)

我正在尝试将kafka代理仅配置为inter-broker kerberos。但是,我似乎经常遇到错误,因为它似乎也想通过kerberos连接zookeers。我目前还没有设置任何zookeeper键。
我的Kafka经纪人jaas config如下:

KafkaServer {

    com.sun.security.auth.module.Krb5LoginModule required
    serviceName=kafkabroker
    keytab="/etc/security/keytabs/kafka_server.keytab"
    useKeyTab=true
    storeKey=true
    principal="kafkabroker/kafkabroker0.domain.name@REALM.COM";

    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="user"
    password="secret"
    user_admin="admin"
    user_alice="secret";
};

Client {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="admin"
    password="secret";
};

服务器属性

sasl.mechanism.inter.broker.protocol=GSSAPI
sasl.enabled.mechanisms=PLAIN, GSSAPI
security.inter.broker.protocol=SASL_SSL
sasl.kerberos.service.name=kafkabroker

我在上述配置中遇到的错误如下:

[2019-02-08 10:08:17,995] ERROR SASL authentication failed using login context 'Client' with exception: {} (org.apache.zookeeper.client.ZooKeeperSaslClient)
javax.security.sasl.SaslException: Error in authenticating with a Zookeeper Quorum member: the quorum member's saslToken is null.
        at org.apache.zookeeper.client.ZooKeeperSaslClient.createSaslToken(ZooKeeperSaslClient.java:279)
        at org.apache.zookeeper.client.ZooKeeperSaslClient.respondToServer(ZooKeeperSaslClient.java:242)
        at org.apache.zookeeper.ClientCnxn$SendThread.readResponse(ClientCnxn.java:805)
        at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:94)
        at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:366)
        at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1145)
[2019-02-08 10:08:18,015] ERROR [ZooKeeperClient] Auth failed. (kafka.zookeeper.ZooKeeperClient)
[2019-02-08 10:08:18,048] ERROR Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
org.apache.zookeeper.KeeperException$AuthFailedException: KeeperErrorCode = AuthFailed for /consumers
        at org.apache.zookeeper.KeeperException.create(KeeperException.java:126)
        at org.apache.zookeeper.KeeperException.create(KeeperException.java:54)
        at kafka.zookeeper.AsyncResponse.maybeThrow(ZooKeeperClient.scala:499)
        at kafka.zk.KafkaZkClient.createRecursive(KafkaZkClient.scala:1456)
        at kafka.zk.KafkaZkClient.makeSurePersistentPathExists(KafkaZkClient.scala:1378)
        at kafka.zk.KafkaZkClient$$anonfun$createTopLevelPaths$1.apply(KafkaZkClient.scala:1370)
        at kafka.zk.KafkaZkClient$$anonfun$createTopLevelPaths$1.apply(KafkaZkClient.scala:1370)
        at scala.collection.immutable.List.foreach(List.scala:392)
        at kafka.zk.KafkaZkClient.createTopLevelPaths(KafkaZkClient.scala:1370)
        at kafka.server.KafkaServer.initZkClient(KafkaServer.scala:373)
        at kafka.server.KafkaServer.startup(KafkaServer.scala:202)
        at io.confluent.support.metrics.SupportedServerStartable.startup(SupportedServerStartable.java:114)
        at io.confluent.support.metrics.SupportedKafka.main(SupportedKafka.java:66)
[2019-02-08 10:08:18,056] INFO shutting down (kafka.server.KafkaServer)
[2019-02-08 10:08:18,058] WARN  (kafka.utils.CoreUtils$)
java.lang.NullPointerException
        at kafka.server.KafkaServer$$anonfun$shutdown$5.apply$mcV$sp(KafkaServer.scala:579)
        at kafka.utils.CoreUtils$.swallow(CoreUtils.scala:86)
        at kafka.server.KafkaServer.shutdown(KafkaServer.scala:579)
        at kafka.server.KafkaServer.startup(KafkaServer.scala:329)
        at io.confluent.support.metrics.SupportedServerStartable.startup(SupportedServerStartable.java:114)
        at io.confluent.support.metrics.SupportedKafka.main(SupportedKafka.java:66)
[2019-02-08 10:08:18,060] INFO [ZooKeeperClient] Closing. (kafka.zookeeper.ZooKeeperClient)
[2019-02-08 10:08:18,063] INFO [ZooKeeperClient] Closed. (kafka.zookeeper.ZooKeeperClient)
[2019-02-08 10:08:18,065] INFO shut down completed (kafka.server.KafkaServer)
[2019-02-08 10:08:18,065] INFO Shutting down SupportedServerStartable (io.confluent.support.metrics.SupportedServerStartable)
[2019-02-08 10:08:18,065] INFO Shutting down KafkaServer (io.confluent.support.metrics.SupportedServerStartable)
[2019-02-08 10:08:18,065] INFO shutting down (kafka.server.KafkaServer)

换句话说,我只希望kerberos用于broker-to-broker,而普通sasl\u-ssl用于broker-zookeeper。这有可能吗?

zour9fqk

zour9fqk1#

所以,我设法让这个工作。我需要用“default\u realms”和“[realms]”详细信息更新/etc/krb5.conf文件。
然后,我更改了server_jaas.conf文件,如下所示:

KafkaServer {
    com.sun.security.auth.module.Krb5LoginModule required
    serviceName=kafkabroker
    keytab="/etc/security/keytabs/kafka_server.keytab"
    useKeyTab=true
    storeKey=true
    principal="kaffka_service_account@REALM";
}

最后,我更新了server.properties文件,如下所示:

sasl.mechanism.inter.broker.protocol=GSSAPI
sasl.enabled.mechanisms=GSSAPI
security.inter.broker.protocol=SASL_SSL
sasl.kerberos.service.name=kafkabroker

相关问题