我正在尝试复制sasl\u平原或sasl\u ssl身份验证,描述如下:http://docs.confluent.io/3.0.0/kafka/sasl.html#sasl-Kafka经纪人配置
在config/server.properties中,我添加了以下4行:
listeners=SASL_SSL://localhost:9092
security.inter.broker.protocol=SASL_SSL
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.enabled.mechanisms=PLAIN
在config/producer.properties中,我添加了以下两行:
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
然后在服务器终端中设置以下环境变量:
KAFKA_OPTS=/home/kafka/kafka_server_jaas.conf
此文件包含以下内容:
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret"
user_admin="admin-secret"
user_alice="alice-secret";
};
在producer终端中,我定义了以下env变量:
KAFKA_OPTS=/home/kafka/kafka_client_jaas.conf
此文件包含以下内容:
KafkaClient {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="alice"
password="alice-dsecret";
};
我使用以下命令启动服务器:
./bin/kafka-server-start.sh config/server.properties
以及制作人的以下命令:
bin/kafka-console-producer.sh --broker-list localhost:9092 --topic test
两个开始都没有问题。但是,只要我在producer控制台上键入一些内容,就会收到以下消息,并不断滚动:
WARN Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
WARN Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
WARN Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
WARN Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
WARN Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
WARN Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
WARN Bootstrap broker localhost:9092 disconnected (org.apache.kafka.clients.NetworkClient)
如果我从服务器和生产者配置中删除安全配置,那么一切都会按预期工作。我用的是Kafka0.10.0.1。
更新:我做了更多的调查,将日志级别改为在服务器上调试会发现一些奇怪的事情。一旦我在server.properties中指定了listeners字段,服务器就会进入一种奇怪的状态。它建立与自身的连接,但无法进行身份验证。本案中的协议是sasl d u明文协议。
日志如下:
2016-09-15 21:43:02 DEBUG SaslClientAuthenticator:204 - Set SASL client state to RECEIVE_HANDSHAKE_RESPONSE
2016-09-15 21:43:02 DEBUG NetworkClient:476 - Completed connection to node 0
2016-09-15 21:43:02 DEBUG Acceptor:52 - Accepted connection from /127.0.0.1 on /127.0.0.1:9092. sendBufferSize [actual|requested]: [102400|102400] recvBufferSize [actual|requested]: [102400|102400]
2016-09-15 21:43:02 DEBUG Processor:52 - Processor 2 listening to new connection from /127.0.0.1:42815
2016-09-15 21:43:02 DEBUG SaslServerAuthenticator:269 - Set SASL server state to HANDSHAKE_REQUEST
2016-09-15 21:43:02 DEBUG SaslServerAuthenticator:310 - Handle Kafka request SASL_HANDSHAKE
2016-09-15 21:43:02 DEBUG SaslServerAuthenticator:354 - Using SASL mechanism 'PLAIN' provided by client
2016-09-15 21:43:02 DEBUG SaslServerAuthenticator:269 - Set SASL server state to AUTHENTICATE
2016-09-15 21:43:02 DEBUG SaslClientAuthenticator:204 - Set SASL client state to INITIAL
2016-09-15 21:43:02 DEBUG SaslClientAuthenticator:204 - Set SASL client state to INTERMEDIATE
2016-09-15 21:43:02 DEBUG SaslServerAuthenticator:269 - Set SASL server state to FAILED
2016-09-15 21:43:02 DEBUG Selector:345 - Connection with /127.0.0.1 disconnected
java.io.IOException: javax.security.sasl.SaslException: Authentication failed: Invalid JAAS configuration [Caused by javax.security.sasl.SaslException: Authentication failed: Invalid username or password]
at org.apache.kafka.common.security.authenticator.SaslServerAuthenticator.authenticate(SaslServerAuthenticator.java:243)
at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:64)
at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:318)
at org.apache.kafka.common.network.Selector.poll(Selector.java:283)
at kafka.network.Processor.poll(SocketServer.scala:472)
绝对没有其他客户端或服务器在运行。这是一个服务器在自言自语。
有什么想法吗?
1条答案
按热度按时间lmvvr0a81#
Kafka论坛提供了帮助。看到了吗http://mail-archives.apache.org/mod_mbox/kafka-users/201609.mbox/%3ccahx2snk11vg7dxnvur9oe97ikfsquot3kblaxyymedj7e14xrq%40mail.gmail.com%3e
我把证件弄错了。他们是:
而不是:
另外,控制台使用者需要以特定的方式调用。首先是标志——应该提供新的消费者。其次,应该指定引导服务器。因此: