Community Articles
Find and share helpful community-sourced technical articles
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.
Labels (1)
New Contributor

It is known that in a secure Kafka environment, we need to explicitly authorize user/principal to either read/write to a Kafka topic as shown below

Grant Read/Write Access to a Topic

To add the following ACL:

"Principals user:bob and user:alice are allowed to perform Operation Read and Write on Topic Test-Topic from Host1 and Host2"

run the CLI with the following options:

bin/kafka-acls.sh --add --allow-principal <strong><em>User</em></strong>:bob --allow-principal User:alice --allow-host host1 --allow-host host2 --operation Read --operation Write --topic test-topic

Grant Full Access to Topic, Cluster, and Consumer Group

To add ACLs to a topic, specify --topic <topic-name> as the resource option. Similarly, to add ACLs to cluster, specify --cluster; to add ACLs to a consumer group, specify --consumer-group <group-name>.

The following examples grant full access for principal bob to topic test-topic and consumer group 10, across the cluster. Substitute your own values for principal name, topic name, and group name.

bin/kafka-acls.sh --topic test-topic --add --allow-principal <strong><em>user</em></strong>:bob --operation ALL --config /usr/hdp/current/kafka-broker/config/server.properties

Ref:https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.2/bk_secure-kafka-ambari/content/kafka-acl-examples.html

ISSUE:

We see that the keyword, "user" is inconsistent across the commands leading to improper authorizations getting effected.

RESOLUTION:

Usage of keyword, "User" is case sensitive and it is dependent on the version of Kafka that is being used,

Apache Kafka 0.8.2 makes it necessary to use the keyword "User" and

Apache Kafka 0.9 onwards, keyword "user" needs to be used for authorizations.

634 Views
Comments

Probably better remove link to Hortonwroks Jira?

New Contributor

Thank you, removed it.

Don't have an account?
Coming from Hortonworks? Activate your account here
Version history
Revision #:
1 of 1
Last update:
‎03-21-2017 05:28 PM
Updated by:
 
Contributors
Top Kudoed Authors