Member since
08-31-2018
2
Posts
0
Kudos Received
0
Solutions
09-01-2018
04:30 AM
Just found the reason here: https://github.com/cloudera/cm_csds/blob/master/KAFKA/src/scripts/control.sh if [[ ${SECURITY_INTER_BROKER_PROTOCOL} == *"SASL"* && ${KERBEROS_AUTH_ENABLED} != "true" ]]; then
echo "security.inter.broker.protocol can not be set to ${SECURITY_INTER_BROKER_PROTOCOL}, as Kerberos is not enabled on this Kafka broker."
exit 1
fi As I correctly understand Kafka brokers can communicate with SASL_SSL without Kerberos Can someone from Cloudera please comment it? Thanks
... View more
08-31-2018
06:50 AM
Hi guys, I have a Kafka cluster and want to enable SASL_SSL without Kerberos. Is it possible? What I changed in kafka.properties: listeners=PLAINTEXT://kafkatest03.loc:9092, SSL://kafkatest03.loc:9093, SASL_SSL://kafkatest03.loc:9094, SASL_PLAINTEXT://kafkatest03.loc:9095
advertised.listeners=PLAINTEXT://kafkatest03.loc:9092, SSL://kafkatest03.loc:9093, SASL_SSL://kafkatest03.loc:9094, SASL_PLAINTEXT://kafkatest03.loc:9095
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
sasl.enabled.mechanisms=SCRAM-SHA-256
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer ssl.keystore.location=... ssl.keystore.password.generator=... ssl.key.password.generator=... ssl.truststore.location=... ssl.truststore.password.generator=...
Added to broker_java_opts: -Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf
KafkaServer {
org.apache.kafka.common.security.scram.ScramLoginModule required
username="admin"
password="admin";
}; When I set security.inter.broker.protocol to PLAINTEXT everything is working and client can auth wirh SASL_SSL using SCRAM-SHA-256, but ACL is not working. According to this: https://github.com/wurstmeister/kafka-docker/issues/218 we need to enable security.inter.broker.protocol=SASL_SSL, but it throws an error: security.inter.broker.protocol can not be set to SASL_SSL, as Kerberos is not enabled Thanks
... View more
Labels:
- Labels:
-
Apache Kafka
-
Security