Kafka客户端应用程序的临时kerberos身份验证失败

Question

我使用最新版本的Kafka，并面临问题瞬时连接我的消费者/生产者（控制台）客户到Kafka经纪人SASL_PLAINTEXT。

这是我的jaas配置文件

KafkaClient {
   com.sun.security.auth.module.Krb5LoginModule required
   useTicketCache=true;
};

以下是我要传递的java属性：

-Djavax.security.auth.useSubjectCredsOnly=false
-Dsecurity.protocol=SASL_PLAINTEXT
-Dsasl.kerberos.service.name=HTTP
-Dsasl.mechanism=GSSAPI

这是我得到的一个例外：

Caused by: org.apache.kafka.common.KafkaException: javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner  authentication information from the user
        at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:127)
        at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:140)
        at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:65)
        at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:88)
        at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:710)
        ... 33 more
Caused by: javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner  authentication information from the user
        at com.sun.security.auth.module.Krb5LoginModule.promptForPass(Krb5LoginModule.java:940)

有人能帮忙吗？

Answer 1

我想建议你的几个选择，

>

如果您试图使用Kafka以外的任何原则对主题进行任何更改，则该操作将失败。Set-Dsasl。kerberos。服务姓名=Kafka

试试设置

export KAFKA_OPTS=“-Djava.security.auth.login.config=/path/to/jaas.conf-Djava.security.krb5.conf=/etc/krb5.conf-Dsun.security.krb5.debug=true”

如果使用控制台生产者/消费者，则需要提供生产者配置/消费者配置。以producer.properties或consumer.properties.配置以下属性

安全性。协议=SASL_明文（或SASL_SSL）SASL。机构=GSSAPI（或普通）

使用命令作为控制台消费者的遵循

kafka-控制台-消费者-引导-服务器主机： 9092-consumer.config /path/to/consumer.properties-主题

希望这会有所帮助：）

Answer 2

jaas文件中缺少principal和keytab。

看https://kafka.apache.org/documentation/#security_sasl_kerberos