kafka sasl:oauthbearer和plain同时使用

ippsafx7  于 2021-06-06  发布在  Kafka
关注(0)|答案(1)|浏览(534)

我想做的是-

For Clients to Broker communication - use OAUTHBEARER authentication
For Broker to Broker communication - use PLAIN authentication

我有以下jaas配置:

{
  KafkaServer {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="inter"
    password="inter-secret"
    user_inter="inter-secret"
    user_admin="YvNzcbmqhA0DfxjP";

    org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
  };

  Client {
    org.apache.zookeeper.server.auth.DigestLoginModule required
    username="zookeeper"
    password="zookeeper-secret";
  };
}

我在server.properties中有以下配置:

sasl.enabled.mechanisms=PLAIN,OAUTHBEARER
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.server.callback.handler.class=br.com.jairsjunior.security.oauthbearer.OauthAuthenticateValidatorCallbackHandler

但如果启动Kafka服务,我会看到如下错误:

used by: java.lang.IllegalArgumentException: Must supply exactly 1 non-null JAAS mechanism configuration (size was 2)
at org.apache.kafka.common.security.oauthbearer.internals.unsecured.OAuthBearerUnsecuredValidatorCallbackHandler.configure(OAuthBearerUnsecuredValidatorCallbackHandler.java:114)
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:122)
... 17 more

这表明kafka不允许指定多个jaas机制配置。
因此,如何指定多个jaas配置,并设置如下身份验证机制:

CLient to Broker ----> OAUTHBEARER
Broker to Broker ----> PLAIN

谢谢!

vddsk6oq

vddsk6oq1#

我目前也在研究同时使用plain和oauthBear的问题,我还没有解决这个问题,但是我用下面的方法解决了您的具体问题。这是我的jaas配置:

internal.KafkaServer {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="admin"
    password="admin-secret"
    user_admin="admin-secret"
    user_test="test";
};

external.KafkaServer {
    org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required
};

Client {
   org.apache.zookeeper.server.auth.DigestLoginModule required
   username="username"
   password="pw";
};

然后我在server.properties中按以下方式设置设置:

inter.broker.listener.name: INTERNAL 
  sasl.mechanism.inter.broker.protocol: PLAIN
  listener.security.protocol.map: INTERNAL:SASL_PLAINTEXT,EXTERNAL:SASL_SSL
  listeners: "INTERNAL://0.0.0.0:9092,EXTERNAL://0.0.0.0:19092"
  sasl.enabled.mechanisms: PLAIN,OAUTHBEARER

  listener.name.external.oauthbearer.sasl.server.callback.handler.class: my.module.kafka.security.oauthbearer.OauthAuthenticateValidatorCallbackHandler
  listener.name.external.oauthbearer.sasl.login.callback.handler.class: my.module.kafka.security.oauthbearer.OauthAuthenticateLoginCallbackHandler

当你这样做的时候,你就不会犯错误了。遗憾的是,当代理想要设置外部连接时,我遇到了另一个错误:

javax.security.auth.callback.UnsupportedCallbackException: Unrecognized SASL Login callback
    at org.apache.kafka.common.security.authenticator.AbstractLogin$DefaultLoginCallbackHandler.handle(AbstractLogin.java:105)
    at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.identifyToken(OAuthBearerLoginModule.java:316)
    at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.login(OAuthBearerLoginModule.java:301)
    ... 32 more

Kafka的经纪人似乎忽视了oauthbearer回调处理程序。这有点奇怪,因为当我将external配置为唯一的侦听器时,它工作得非常好。
我希望它能帮助你解决你的问题!

相关问题