使用SASL/PLAIN認證
server端
1.配置broker
kafka_server_jaas.conf
內容
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret"
user_admin="admin-secret"
user_alice="alice-secret";
};
username\password是broker初始化鏈接其他broker的使用的；上例admin是內部broker通信使用；
user_[user]=[password]是用戶鏈接到broker合法驗證使用的
2.添加JAAS配置到JVM的配置中，文件為kafka-server-start.sh
export KAFKA_OPTS="-Djava.security.auth.login.config=/home/app/projects/kafka/config/common/kafka_server_jaas.conf"
分割下解釋
-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf
該參數為添加為用戶認證的server端
3.添加SASL端口和SASL認證方式添加到 server.properties
listeners=SASL_PLAINTEXT://host.name:port
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.enabled.mechanisms=PLAIN
認證權限配置
server.propert文件
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
allow.everyone.if.no.acl.found=true //對所有用戶topic可見
super.users=User:Bob;User:Alice
client端
在kafka-console-producer.sh中添加
export KAFKA_OPTS="-Djava.security.auth.login.config=/home/app/projects/kafka/config/kafka_client_jaas.conf"
kafka_client_jaas.conf文件添加如下內容
KafkaClient {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="alice"
password="alice-secret";
};
添加配置在producer.properties或consumer.properties
security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN
授權
~/projects/kafka/bin/kafk-acls.sh --authorizer-properties zookeeper.connect=localhost:2181/tkafka --add --allow-principal User:alice --operation Read --operation Write --topic T_acl-1
生產者
./projects/kafka/bin/kafka-console-producer.sh --broker-list 127.0.0.1:9092 --topic t-cal --producer.config ~/projects/kafka/config/producer.properties
消費者