启用Sasl身份验证时，Kafka从Zookeeper收到Sasl异常

Question

我正在尝试建立一个开源的Kafka集群。集群由2个Kafka节点和1个动物园管理员组成。当我试图启用动物园管理员SASL身份验证时，我遇到了以下异常。提供Zookeeper和Kafka配置文件。请在我做错的地方帮助我。

ERROR SASL authentication failed using login context 'Client' with exception: {} (org.apache.zookeeper.client.ZooKeeperSaslClient)
javax.security.sasl.SaslException: Error in authenticating with a Zookeeper Quorum member: the quorum member's saslToken is null.
at org.apache.zookeeper.client.ZooKeeperSaslClient.createSaslToken(ZooKeeperSaslClient.java:279)
at org.apache.zookeeper.client.ZooKeeperSaslClient.respondToServer(ZooKeeperSaslClient.java:242)
at org.apache.zookeeper.ClientCnxn$SendThread.readResponse(ClientCnxn.java:805)
at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:94)
at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:366)
at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1145)

我的动物园管理员设置如下

1） 动物园管理员jaas.conf

Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
keyTab="/tmp/zookeeper.service.keytab"
principal="zookeeper/<<Zookeeper-SERVER-INTERNAL-DNS>>@EXAMPLE.COM";
};

zookeeper.properties

dataDir=/home/ubuntu/zookeeper
clientPort=2181
maxClientCnxns=0

authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000

3)导出" ZOOKEEPER _ OPTS =-DJ ava . security . auth . log in . config =/home/Ubuntu/Kafka/config/ZOOKEEPER _ JAAS . conf "

4）使用zookeeper Keytab创建工单

5)成功启动zookeeper服务器，该服务器绑定在端口2181。

Kafka代理设置

kafka_server_jaas.conf

KafkaServer {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    storeKey=true
    keyTab="/tmp/kafka.service.keytab"
    principal="kafka/<<KAFKA-SERVER-PUBLIC-DNS>>@EXAMPLE.COM";
};

Client {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    storeKey=true
    servicename="zookeeper"
    keyTab="/tmp/kafka.service.keytab"
    principal="kafka/<<KAFKA-SERVER-PUBLIC-DNS>>@EXAMPLE.COM";
};

2） Kafka_client_jass

KafkaClient {
 com.sun.security.auth.module.Krb5LoginModule required
 useTicketCache=true;
 };

3)服务器.属性

broker.id=0

listeners=PLAINTEXT://0.0.0.0:9092,SSL://0.0.0.0:9093,SASL_SSL://0.0.0.0:9094
advertised.listeners=PLAINTEXT://<<KAFKA-SERVER-PUBLIC-DNS>>:9092,SSL://<<KAFKA-SERVER-PUBLIC-DNS>>:9093,SASL_SSL://<<KAFKA-SERVER-PUBLIC-DNS>>:9094

zookeeper.connect=<<ZOOKEEPER-SERVER-PRIVATE-DNS>>:2181

sasl.enabled.mechanisms=GSSAPI
sasl.kerberos.service.name=kafka

ssl.keystore.location=/home/ubuntu/ssl/kafka.server.keystore.jks
ssl.keystore.password=serversecret
ssl.key.password=serversecret
ssl.truststore.location=/home/ubuntu/ssl/kafka.server.truststore.jks
ssl.truststore.password=serversecret

ssl.client.auth=required

num.network.threads=3
num.io.threads=8
socket.send.buffer.bytes=102400
socket.receive.buffer.bytes=102400
socket.request.max.bytes=104857600
auto.create.topics.enable=false
log.dirs=/home/ubuntu/kafka-logs
num.partitions=1
num.recovery.threads.per.data.dir=1
offsets.topic.replication.factor=1
transaction.state.log.replication.factor=1
transaction.state.log.min.isr=1
log.retention.hours=168
log.segment.bytes=1073741824
log.retention.check.interval.ms=300000
zookeeper.connection.timeout.ms=6000

4）导出“KAFKA_OPTS=-Djava.security.auth.login.config=/home/ubuntu/kafka/config/kafka_server_jaas.config”

5)使用Kafka Keytab创建票证。

6）我启动了Kafka经纪人，并得到了上面提到的例外。

Answer 1

而不是ZOOKEEPER_OPTS动物园管理员设置中使用KAFKA_OPTS（第3点）。这将有效。谢谢！