CODEWITHSUNDEEP
apache-kafkaapache-zookeeperkerberosjaassasl
Satya_1
Satya_1

Reputation: 141

Zoo keeper SASL security

I'm using zookeeper 3.4.12 version and when trying to enable SASL found below error. Can someone help on this.

Client {
 com.sun.security.auth.module.Krb5LoginModule required
 useKeyTab=true
 storeKey=true
 useTicketCache=true
 keyTab="/tmp/kafka/zookeeper.service.keytab
 principal="zookeeper/[email protected]";
};

Error :

2018-11-02 09:35:01,998] ERROR SASL authentication failed using login context 'Client' with exception: {} (org.apache.zookeeper.client.ZooKeeperSaslClient) javax.security.sasl.SaslException: Error in authenticating with a Zookeeper Quorum member: the quorum member's saslToken is null

Upvotes: 2

Views: 14377

Answers (4)

Ben DeMott
Ben DeMott

Reputation: 3604

I was experiencing the same problem...

SaslException: Error in authenticating with a Zookeeper Quorum member: the quorum member's saslToken is null

This error was also in the Zookeeper Server log:

ERROR [NIOWorkerThread-6:ZooKeeperServer@1191] - cnxn.saslServer is null: cnxn object did not initialize its saslServer properly.

My configuration, using mutual kerberos authentication between zookeeper instances.

The solution

Missing "Server" Section

My problem was that I didn't have the Server section present in my server jaas configuration for Zookeeper.

I need something like:

QuorumServer {
       com.sun.security.auth.module.Krb5LoginModule required
       useKeyTab=true
       keyTab="/etc/security/keytabs/zookeeper.keytab"
       storeKey=true
       useTicketCache=false
       debug=false
       principal="zookeeper/[email protected]";
};

QuorumLearner {
       com.sun.security.auth.module.Krb5LoginModule required
       useKeyTab=true
       keyTab="/etc/security/keytabs/zookeeper.keytab"
       storeKey=true
       useTicketCache=false
       debug=false
       principal="zookeeper/[email protected]";
};

Server {
       com.sun.security.auth.module.Krb5LoginModule required
       useKeyTab=true
       keyTab="/etc/security/keytabs/zookeeper.keytab"
       storeKey=true
       useTicketCache=false
       principal="zookeeper/[email protected]";
};

When clients connect to Zookeeper they will authenticate against the Server section of this configuration. This is required for SASL to work.

Also make sure you have conf/java.env set with something like:

SERVER_JVMFLAGS="${SERVER_JVMFLAGS} -Djava.security.auth.login.config=/opt/zookeeper/conf/server-jaas.conf"
CLIENT_JVMFLAGS="${CLIENT_JVMFLAGS} -Djava.security.auth.login.config=/opt/zookeeper/conf/client-jaas.conf"

Upvotes: 0

Pubudu Sitinamaluwa
Pubudu Sitinamaluwa

Reputation: 978

I think the problem is, you are missing a double quotation mark at 

keyTab="/tmp/kafka/zookeeper.service.keytab

Upvotes: 0

Satya_1
Satya_1

Reputation: 141

Issue is fixed, spaces in jaas were causing the problem

Upvotes: 1

Gery
Gery

Reputation: 649

First step in Zookeeper security is to secure quorum peers communication. Complete explanation here.

Your Zookeeper jaas file should have QuorumServer and QuorumLearner sections.

Next, you can secure communication between Zookeeper cluster and clients as Kafka. Full explanation here

You add a Server section in Zookeeper jaas file and your Kafka jaas file should have a Client section

Upvotes: 0

Related Questions