启用 Kerberos 后启动 Kafka 失败“SASL 身份验证失败”答案

【问题标题】：Failed to start Kafka after enabling Kerberos "SASL authentication failed"启用 Kerberos 后启动 Kafka 失败“SASL 身份验证失败”
【发布时间】：2023-03-22 04:07:02
【问题描述】：

Kafka 版本：kafka_2.1.1（二进制）

当我启用 Kerberos 时，我会密切关注官方文档 (https://kafka.apache.org/documentation/#security_sasl_kerberos)。

当我启动 Kafka 时，出现以下错误：

[2019-02-23 08:55:44,622] ERROR SASL authentication failed using login context 'Client' with exception: {} (org.apache.zookeeper.client.ZooKeeperSaslClient)
javax.security.sasl.SaslException: Error in authenticating with a Zookeeper Quorum member: the quorum member's saslToken is null.
    at org.apache.zookeeper.client.ZooKeeperSaslClient.createSaslToken(ZooKeeperSaslClient.java:279)
    at org.apache.zookeeper.client.ZooKeeperSaslClient.respondToServer(ZooKeeperSaslClient.java:242)
    at org.apache.zookeeper.ClientCnxn$SendThread.readResponse(ClientCnxn.java:805)
    at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:94)
    at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:366)
    at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1145)
[2019-02-23 08:55:44,625] ERROR [ZooKeeperClient] Auth failed. (kafka.zookeeper.ZooKeeperClient)
[2019-02-23 08:55:44,746] ERROR Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)

我几乎使用默认的 krb5.conf。

includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
 default_realm = EXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
  kdc = localhost
  admin_server = localhost
 }

[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM

我传给Kafka的jaas文件如下：

KafkaServer {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    storeKey=true
    keyTab="/etc/security/keytabs/localhost.keytab"
    principal="kafka/localhost@EXAMPLE.COM";
};

// Zookeeper client authentication
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
keyTab="/etc/security/keytabs/localhost.keytab"
principal="kafka/localhost@EXAMPLE.COM";
};

我还将ENV设置如下：

"-Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf -Dzookeeper.sasl.client.username=kafka"

我搜索了很多帖子，但没有任何进展。我想问题可能是我在 Kerberos 中创建条目时使用的“本地主机”。但我不太确定如何解决。我的目标是建立一个本地的 Kafka+Kerberos 测试环境。

【问题讨论】：

您是否按照步骤 3 和步骤 4 进行操作
“使用 SASL/Kerberos 进行身份验证”部分有 3 个步骤。我遵循了“先决条件”和“配置 Kafka 代理”。但我没有做最后一个“配置 Kafka 客户端”，因为最后一个是针对客户端（生产者、消费者、连接工作人员等）的。
在配置 Kafka Brokers 时，您是否按照步骤 3 和步骤 4 进行操作

标签： apache-kafka apache-zookeeper kerberos sasl

【解决方案1】：

In our case, the krb5 kerberos_config file wasn't read properly. if you're using keytab thru' yml then it'd need to be removed first. This was with IBM JDK though and had to use the following to set System.setProperty("java.security.auth.login.config", JaasConfigFileLocation);

KafkaClient {
com.ibm.security.auth.module.Krb5LoginModule required
useDefaultKeytab=false
credsType=both
principal="xkafka@xxx.NET"
useKeytab="/opt/apps/xxxr/my.keytab";
};

【讨论】：