CODEWITHSUNDEEP
apache-kafkaapache-zookeeperkerberos
vespasien
vespasien

Reputation: 183

Securing Kafka and Zookeeper with Kerberos

I'm trying to setup a kerberos identification between zookeeper and kafka.

I have followed the configuration steps available here : https://docs.confluent.io/4.1.1/kafka/authentication_sasl_gssapi.html#sasl-gssapi-broker.

The kafka brokers successfully connect to the zookeeper ensemble and the brokers are setting ACLs on znodes.

In Zookeeper, I can see the znodes /brokers/ids, but the ACLs are set like this :

'world,'anyone
: r
'sasl,'kafka/[email protected]
: cdrwa

The first broker creates the znode, put its ACL and make it unmodiafiable for all nodes that want to add their ids.

The docs says that we should use the same principal for all the brokers but the example of the documentation does not match this recommendation :

 // ZooKeeper client authentication
 Client {
   com.sun.security.auth.module.Krb5LoginModule required
   useKeyTab=true
   storeKey=true
   keyTab="/etc/security/keytabs/kafka_server.keytab"
   principal="kafka/[email protected]";
};

Shoud I create a principal like [email protected] and use it the Client section of my JAAS file on each broker ? If yes can I share the keytab for this user on each broker ?

Thanks for the help.

Upvotes: 1

Views: 2545

Answers (2)

dawsaw
dawsaw

Reputation: 2313

You can drop the host from the principal and use the same one for all brokers, you can set acls manually (not ideal), or you can add these to your zookeeper configuration as well

kerberos.removeHostFromPrincipal = true
kerberos.removeRealmFromPrincipal = true

Any of those three options should help here.

Upvotes: 2

karan
karan

Reputation: 68

The properties kerberos.removeHostFromPrincipal, kerberos.removeRealmFromPrincipal were not working for me. After going through the source code of zookeeper version 3.4.14 I passed the above property as an JVM argument such as 

-Dzookeeper.kerberos.removeHostFromPrincipal=true
-Dzookeeper.kerberos.removeRealmFromPrincipal=true

Also In my case as it was the case of cross realm ticket authetication, I added the auth rules like :

-Dzookeeper.security.auth_to_local=RULE:[2:$1](.*)

Have a look at the class https://github.com/apache/zookeeper/blob/release-3.4.14/zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/SaslServerCallbackHandler.java

Now my topics ACLS look like this 

getAcl /kafka-cluster/config/topics/test20
'world,'anyone
: r
'sasl,'zookeeper
: cdrwa

Upvotes: 0

Related Questions