Kafka授权仅在端口9092上失败

Question

  - KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND=false
  - KAFKA_SSL_CLIENT_AUTH=required
  - KAFKA_SECURITY_INTER_BROKER_PROTOCOL=SASL_SSL
  - KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
  - KAFKA_SASL_ENABLED_MECHANISMS=PLAIN
  - KAFKA_AUTHORIZER_CLASS_NAME=kafka.security.authorizer.AclAuthorizer
  - KAFKA_SUPER_USERS="User:admin"
  - KAFKA_OPTS=-Djava.security.auth.login.config={{ kafka_secrets_dir }}/kafka_jaas.conf

KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin"
  user_admin="admin"
  user_second_user="read_user";
};

Client {
org.apache.kafka.common.security.plain.PlainLoginModule required
 username="admin"
 password="admin";
};

配置使用者ACL

bin/kafka-acls --authorizer-properties zookeeper.connect=my.host1:2181,host2:2181,host3:2181 --add --allow-principal User:second_user --consumer --topic '*' --group '*'

配置生产者ACL

kafka-acls --authorizer-properties zookeeper.connect=my.host1:2181,host2:2181,host3:2181 --add --allow-principal User:second_user --producer --topic '*'

我想在两个端口上都用Kafka。9093带有SSL加密和9092 Witout。因此，我用一个简单的控制台消费者/生产者对它进行了测试。端口9093工作正常，我可以消费和产生消息。问题是它不能在端口9092上工作。我总是在TopicAuthorizationException:未被授权访问主题:[test_topic]时得到身份验证错误。我用“second_user”甚至超级用户“admin”测试了它。为什么它只与安全端口一起工作？我错过了什么配置吗？

#consumer.properties

ssl.endpoint.identification.algorithm=
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
ssl.truststore.location=/home/vagrant/kafka-2.8.0/ssl/kafka.truststore.jks
ssl.truststore.password=changeme
ssl.protocol=TLS
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required \
    username="admin" \
    password="admin";


# create consumer => This is working!
/bin/kafka-console-consumer.sh --bootstrap-server host1:9093,host2:9093,host3:9093 --topic test_topic --from-beginning --consumer.config consumer.properties

#consumer.properties
security.protocol=PLAINTEXT
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required \
    username="admin" \
    password="admin";

#create consumer
kafka-console-consumer.sh --bootstrap-server host1:9092,host2:9092,host3:9092 --topic test_topic --from-beginning --consumer.config consumer.properties

=>TopicAuthorizationException: Not authorized to access topics: [test_topic]

我还用python和confluent-kafka-python包（不工作）测试了它。
test.py

self.consumer = Consumer({
            'bootstrap.servers': "host1:9092,host2:9092,host3:9092",
            'group.id': f"test",
            'security.protocol': "PLAINTEXT",
            'sasl.mechanism': 'PLAIN',
            'sasl.username': 'admin',
            'sasl.password': "admin"
        })
=> FindCoordinator response error: Group authorization failed

Answer 1

您没有在端口9092上启用身份验证，

与KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND的组合

，您将获得授权失败，