码迷,mamicode.com
首页 > 其他好文 > 详细

kafka sasl/plain安全认证

时间:2020-01-07 13:14:40      阅读:105      评论:0      收藏:0      [点我收藏+]

标签:cer   topic   sap   move   host   安全认证   ble   module   prope   

1.SASL认证机制版本支持

SASL/GSSAPI (Kerberos) - starting at version 0.9.0.0
SASL/PLAIN - starting at version 0.10.0.0
SASL/SCRAM-SHA-256 and SASL/SCRAM-SHA-512 - starting at version 0.10.2.0

2.以下采用SASL/PLAIN进行认证操作

  zookeeper配置

1)修改zoo.cfg增加两行配置:
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
requireClientAuthScheme=sasl

2)配置JAAS文件:conf目录下创建zk_server_jaas.conf(定义了需要链接到Zookeeper服务器的用户名和密码)
Server {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-sec";
};

3)加入需要的包:(从kafka下拷贝)
kafka-clients-0.10.0.1.jar
lz4-1.3.0.jar
slf4j-api-1.7.21.jar
slf4j-log4j12-1.7.21.jar
snappy-java-1.1.2.6.jar

3)修改zkEnv.sh
最后一行添加
export SERVER_JVMFLAGS=" -Djava.security.auth.login.config=/usr/local/zookeeper/conf/zk_server_jaas.con"
4)启动Zookeeper  

 kafka服务的配置

1)kafka增加认证信息:conf/kafka_server_jaas.conf
创建JAAS文件:
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-sec"
user_admin="admin-sec"
user_producer="prod-sec"
user_consumer="cons-sec";
};

2)配置server.properties
listeners=SASL_PLAINTEXT://主机名称:9092
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.enabled.mechanisms=PLAIN
sasl.mechanism.inter.broker.protocol=PLAIN
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
allow.everyone.if.no.acl.found=true //当没有找到ACL配置时,允许所有的访问操作。


3)修改启动脚本 bin/kafka-server-start.sh
修改
exec $base_dir/kafka-run-class.sh kafka.Kafka "$@"
为
exec $base_dir/kafka-run-class.sh $EXTRA_ARGS -Djava.security.auth.login.config=/usr/local/kafka/config/kafka_server_jaas.conf kafka.Kafka "$@"

  kafka客户端配置

1)创建JAAS文件:
消费者:conf/kafka-consumer-jaas.conf
KafkaClient {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="consumer"
password="cons-sec";
};
生产者:conf/kafka-producer-jaas.conf
KafkaClient {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="producer"
password="prod-sec";
};

2)修改客户端配置信息:
分别在conf/producer.properties和conf/consumer.properties添加认证机制
security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN
consumer.properties中额外加入分组配置
group.id=test-group
3)修改客户端脚本指定JAAS文件加载:

生产者bin/kafka-console-producer.sh:
修改
exec $(dirname $0)/kafka-run-class.sh kafka.tools.ConsoleProducer "$@"
为
exec $(dirname $0)/kafka-run-class.sh -Djava.security.auth.login.config=/usr/local/kafka/config/kafka-producer-jaas.conf kafka.tools.ConsoleProducer "$@"

消费者bin/kafka-console-consumer.sh:
修改
exec $(dirname $0)/kafka-run-class.sh kafka.tools.ConsoleConsumer "$@"
为
exec $(dirname $0)/kafka-run-class.sh -Djava.security.auth.login.config=/usr/local/kafka/config/kafka-consumer-jaas.conf kafka.tools.ConsoleConsumer "$@"

  进行授权

1)创建主题 test
2)增加生产权限
./bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:producer --operation Write --topic test
3)配置消费权限
./bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:consumer --operation Read --topic test
4)配置消费分组权限
./bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:consumer --operation Read --group test-group
5)查看配置的权限
./bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --list

6)取消权限
./bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --remove --allow-principal User:producer --operation Write --topic test

测试
1)生产数据
./bin/kafka-console-producer-jaas.sh --topic test --broker-list 192.168.1.20:9092 --producer.config config/producer-jaas.properties

2)消费数据
./bin/kafka-console-consumer-jaas.sh --topic test --bootstrap-server 192.168.1.20:9092 --consumer.config config/consumer-jaas.properties

  

 

kafka sasl/plain安全认证

标签:cer   topic   sap   move   host   安全认证   ble   module   prope   

原文地址:https://www.cnblogs.com/lvy6/p/12159558.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!