kafka server使用kerberos

本機爲kafka server服務器

 

在本地安裝kerberos客戶端

 

建立本機princ: addprinc test/192.168.1.170@YLH.COM

 

根據本機的ip生成keytab: xst -k ylh.keytab test/192.168.1.170

 

修改kafka/config/server.properties

listeners=PLAINTEXT://192.168.1.170:9092, SASL_PLAINTEXT://192.168.1.170:9093

advertised.listeners=PLAINTEXT://192.168.1.170:9092, SASL_PLAINTEXT://192.168.1.170:9093

authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer . //acl相關，配置後才能啓用acl

security.inter.broker.protocol= SASL_PLAINTEXT

sasl.mechanism.inter.broker.protocol=GSSAPI

sasl.enabled.mechanisms=GSSAPI

sasl.kerberos.service.name=test //這裏的service.name要跟上面創建的principal相對應，kafka/kafkahost3@EXAMPLE.COM的principal服務名就是kafka

super.users=User:test //這裏的User要跟上面創建的principal相對應，acl相關，broker服務自己是採用kafka這個服務身份進行交互，只有配置成superuser才能獲取集羣內的metadata信息

 

 

創建kafka/config/kafka_server_jaas.conf文件, 如下三個是可選的

KafkaServer{

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

keyTab="/home/yao/ylh170.keytab"

principal="test/192.168.1.170@YLH.COM";

};

 

//爲了bin目錄下kafka-console-consumer.sh之類的的腳本使用的

KafkaClient{

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

keyTab="/home/yao/ylh170.keytab"

principal="test/192.168.1.170@YLH.COM";

};

 

//集羣使用的zookeeper並無啓用kerberos，因此沒有client模塊

Client {

  com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=true

storeKey=true

keyTab="/home/yao/ylh170.keytab"

principal="test/192.168.1.170@YLH.COM";

};

 

 

修改kafka/bin/kafka-server-start.sh, 修改exec $base_dir/kafka-run-class.sh $EXTRA_ARGS 行,-Dsun.security.krb5.debug=true爲可選，開啓kerberos日誌

exec $base_dir/kafka-run-class.sh $EXTRA_ARGS -Dsun.security.krb5.debug=true -Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=/home/yao/software/kafka_kerberos/config/kafka_server_jaas.conf kafka.Kafka "$@"

 

安裝kerberos: https://my.oschina.net/u/185335/blog/2963061

kafka sever配置kerberos: https://my.oschina.net/u/185335/blog/2963062

kafka client使用kerberos: https://my.oschina.net/u/185335/blog/2963063