绕过端口 9092 的 kafka 授权（纯文本）

Question

我想为我的融合 kafka 添加身份验证和授权，这些Kafka与 docker 一起运行。这应该只发生在端口9093上，9092应该像以前一样工作，因为IP表规则阻止了外部客户端的端口。因此，我使用了以下配置：

=

以下是我配置的一部分：
Kafka容器环境变量

  - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://my.host.ip:9092,SASL_SSL://my.host.ip:9093
  - KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND=false
  - KAFKA_SSL_CLIENT_AUTH=required
  - KAFKA_SECURITY_INTER_BROKER_PROTOCOL=SASL_SSL
  - KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
  - KAFKA_SASL_ENABLED_MECHANISMS=PLAIN
  - KAFKA_AUTHORIZER_CLASS_NAME=kafka.security.authorizer.AclAuthorizer
  - KAFKA_SUPER_USERS="User:admin"
  - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/secrets

Zookeeper容器环境变量

  - ZOOKEEPER_SERVERS=0.0.0.0:2888:3888;my.host.ip:2888:3888
  - ZOOKEEPER_SERVER_ID=1
  - ZOOKEEPER_CLIENT_PORT=2181
  - ZOOKEEPER_STANDALONE_ENABLED=false
  - ZOOKEEPER_DATA_DIR=/kafka/data
  - ZOOKEEPER_AUTH_PROVIDER_SASL=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
  - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/secrets/zookeeper_jaas.conf

由于我只想为SASL_SSL侦听器配置身份验证机制，因此我使用以下jaas配置，如下所述：https://docs.confluent.io/platform/current/kafka/authentication_sasl/index.html#recommended-代理jaas配置。

kafka_jaas.config

KafkaServer {
listener.name.sasl_ssl.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin"
  user_admin="admin"
};

Client {
org.apache.kafka.common.security.plain.PlainLoginModule required
 username="admin"
 password="admin";
};

zookeeper_jaas.config

Server {
       org.apache.zookeeper.server.auth.DigestLoginModule required
       user_admin="admin";
};

运行kafka时，出现以下错误：

[main-SendThread(s415vm2140.detss.corpintra.net:2181)] WARN org.apache.zookeeper.ClientCnxn - SASL configuration failed: javax.security.auth.login.LoginException: Zookeeper client cannot authenticate using the 'Client' section of the supplied JAAS configuration: '/etc/kafka/secrets/kafka_jaas.conf' because of a RuntimeException: java.lang.SecurityException: java.io.IOException: Configuration Error:
    Line 2: expected [controlFlag] Will continue connection to Zookeeper server without SASL authentication, if Zookeeper server allows it.

如何实现客户端在连接到端口9092时不需要身份验证？

Answer 1

在这里阅读更多： https://docs.confluent.io/platform/current/security/zk-security.html

你设置动物园管理员使用摘要，你设置客户端使用普通kafka_jaas

KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
     username="admin"
      password="admin"
      user_admin="admin";
};

Client {
       org.apache.zookeeper.server.auth.DigestLoginModule required
       username="admin"
       password="admin";
};

在动物园管理员_jaas

Server {
   org.apache.zookeeper.server.auth.DigestLoginModule required
       username="admin"
       password="admin"
       user_admin="admin";
};

P. s.1.listener.name.sasl_ssl.plain.sasl.jaas.config=在您的KafkaServer是不正确的

在这里，您还可以使用普通配置的示例

Kafka SASL动物园管理员认证