Member since 
    
	
		
		
		08-31-2018
	
	
	
	
	
	
	
	
	
	
	
	
	
	
			
      
                2
            
            
                Posts
            
        
                0
            
            
                Kudos Received
            
        
                0
            
            
                Solutions
            
        
			
    
	
		
		
		09-01-2018
	
		
		04:30 AM
	
	
	
	
	
	
	
	
	
	
	
	
	
	
		
	
				
		
			
					
				
		
	
		
					
							 Just found the reason here: https://github.com/cloudera/cm_csds/blob/master/KAFKA/src/scripts/control.sh     if [[ ${SECURITY_INTER_BROKER_PROTOCOL} == *"SASL"* && ${KERBEROS_AUTH_ENABLED} != "true" ]]; then
        echo "security.inter.broker.protocol can not be set to ${SECURITY_INTER_BROKER_PROTOCOL}, as Kerberos is not enabled on this Kafka broker."
        exit 1
fi  As I correctly understand Kafka brokers can communicate with SASL_SSL without Kerberos  Can someone from Cloudera please comment it?     Thanks 
						
					
					... View more
				
			
			
			
			
			
			
			
			
			
		
			
    
	
		
		
		08-31-2018
	
		
		06:50 AM
	
	
	
	
	
	
	
	
	
	
	
	
	
	
		
	
				
		
			
					
				
		
	
		
					
							 Hi guys,     I have a Kafka cluster and want to enable SASL_SSL without Kerberos.  Is it possible?     What I changed in kafka.properties:     listeners=PLAINTEXT://kafkatest03.loc:9092, SSL://kafkatest03.loc:9093, SASL_SSL://kafkatest03.loc:9094, SASL_PLAINTEXT://kafkatest03.loc:9095
advertised.listeners=PLAINTEXT://kafkatest03.loc:9092, SSL://kafkatest03.loc:9093, SASL_SSL://kafkatest03.loc:9094, SASL_PLAINTEXT://kafkatest03.loc:9095
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
sasl.enabled.mechanisms=SCRAM-SHA-256
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer    ssl.keystore.location=...  ssl.keystore.password.generator=...  ssl.key.password.generator=...  ssl.truststore.location=...  ssl.truststore.password.generator=...
     Added to broker_java_opts:     -Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf
KafkaServer {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="admin"
    password="admin";
};        When I set security.inter.broker.protocol to PLAINTEXT everything is working and client can auth wirh SASL_SSL using SCRAM-SHA-256, but ACL is not working.     According to this:  https://github.com/wurstmeister/kafka-docker/issues/218  we need to enable  security.inter.broker.protocol=SASL_SSL, but it throws an error:     security.inter.broker.protocol can not be set to SASL_SSL, as Kerberos is not enabled           Thanks 
						
					
					... View more
				
			
			
			
			
			
			
			
			
			
		
		
			
				
						
							Labels:
						
						
		
			
	
					
			
		
	
	
	
	
				
		
	
	
- Labels:
 - 
						
							
		
			Apache Kafka
 - 
						
							
		
			Security