☰

带 ACL 的 kafka 无法连接 zk 并停止

tag-icon • tag-icon zookeeper kafka
带 ACL 的 kafka 无法连接 zk 并停止

我有一个 kafka 安装（带有 ssl 侦听器和 ssl 客户端身份验证）。它工作正常，直到我尝试添加 ACL。这是错误（底部有完整错误）：

[edit-1] kafka 启动时第一个错误是：

[2018-07-25 14:15:10,498] ERROR Exception while trying to create SASL client: java.lang.ArrayIndexOutOfBoundsException: 0 (org.apache.zookeeper.client.ZooKeeperSaslClient)

以下是配置和来自日志的更多信息：

[2018-07-25 12:22:27,156] ERROR SASL authentication with Zookeeper Quorum member failed: javax.security.sasl.SaslException: saslClient failed to initialize properly: it's null. (org.apache.zookeeper.ClientCnxn)

在 kafka/conf/server.properties 中我添加了以下内容：

listeners=SASL_PLAINTEXT://:9092,SSL://:9093

security.inter.broker.protocol=SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=PLAIN

ssl.keystore.location=/some-path/server.keystore.jks
ssl.keystore.password=password
ssl.key.password=password
ssl.truststore.location=/some-path/server.truststore.jks
ssl.truststore.password=password
ssl.client.auth=required
# without the next 2 lines kafka works fine but with no ACL
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
super.users=User:CN=bob,OU=bob,O=bob,L=bob,ST=bob,C=il
allow.everyone.if.no.acl.found=false
sasl.enabled.mechanisms=PLAIN

zookeeper/conf/zoo.cfg：

authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
#requireClientAuthScheme=sasl
quorum.auth.enableSasl=true
quorum.auth.learnerRequireSasl=true
quorum.auth.serverRequireSasl=true
#quorum.auth.learner.loginContext=QuorumLearner
#quorum.auth.server.loginContext=QuorumServer
#quorum.auth.kerberos.servicePrincipal=servicename/_HOST
quorum.cnxn.threads.size=20

另外还有jaas文件kafka jaas：

KafkaServer {
   org.apache.kafka.common.security.plain.PlainLoginModule required
   username="kafkabroker"
   password="kafkabroker-secret";
};

Client {
    org.apache.zookeeper.server.auth.DigestLoginModule required
    username="admin"
    password="admin";
};

zookeeper jaas：

Server {
    org.apache.zookeeper.server.auth.DigestLoginModule required
    username="admin"
    password="admin";
};

启动时 kafka log 的完整错误：

[2018-07-25 12:22:27,120] ERROR Exception while trying to create SASL client: java.lang.ArrayIndexOutOfBoundsException: 0 (org.apache.zookeeper.client.ZooKeeperSaslClient)
[2018-07-25 12:22:27,121] INFO Opening socket connection to server localhost/127.0.0.1:2181. Will attempt to SASL-authenticate using Login Context section 'Client' (org.apache.zookeeper.ClientCnxn)
[2018-07-25 12:22:27,132] INFO Socket connection established to localhost/127.0.0.1:2181, initiating session (org.apache.zookeeper.ClientCnxn)
[2018-07-25 12:22:27,154] INFO Session establishment complete on server localhost/127.0.0.1:2181, sessionid = 0x100007b700f0003, negotiated timeout = 6000 (org.apache.zookeeper.ClientCnxn)
[2018-07-25 12:22:27,156] ERROR SASL authentication with Zookeeper Quorum member failed: javax.security.sasl.SaslException: saslClient failed to initialize properly: it's null. (org.apache.zookeeper.ClientCnxn)
[2018-07-25 12:22:27,161] ERROR Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
kafka.zookeeper.ZooKeeperClientAuthFailedException: Auth failed either before or while waiting for connection
    at kafka.zookeeper.ZooKeeperClient.$anonfun$waitUntilConnected$3(ZooKeeperClient.scala:231)
    at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
    at kafka.utils.CoreUtils$.inLock(CoreUtils.scala:250)
    at kafka.zookeeper.ZooKeeperClient.waitUntilConnected(ZooKeeperClient.scala:221)
    at kafka.zookeeper.ZooKeeperClient.<init>(ZooKeeperClient.scala:95)
    at kafka.zk.KafkaZkClient$.apply(KafkaZkClient.scala:1548)
    at kafka.server.KafkaServer.createZkClient$1(KafkaServer.scala:348)
    at kafka.server.KafkaServer.initZkClient(KafkaServer.scala:372)
    at kafka.server.KafkaServer.startup(KafkaServer.scala:202)
    at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:38)
    at kafka.Kafka$.main(Kafka.scala:75)
    at kafka.Kafka.main(Kafka.scala)
[2018-07-25 12:22:27,163] INFO shutting down (kafka.server.KafkaServer)
[2018-07-25 12:22:27,165] WARN  (kafka.utils.CoreUtils$)
java.lang.NullPointerException
    at kafka.server.KafkaServer.$anonfun$shutdown$6(KafkaServer.scala:572)
    at kafka.utils.CoreUtils$.swallow(CoreUtils.scala:85)
    at kafka.server.KafkaServer.shutdown(KafkaServer.scala:572)
    at kafka.server.KafkaServer.startup(KafkaServer.scala:329)
    at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:38)
    at kafka.Kafka$.main(Kafka.scala:75)
    at kafka.Kafka.main(Kafka.scala)
[2018-07-25 12:22:27,173] INFO shut down completed (kafka.server.KafkaServer)
[2018-07-25 12:22:27,174] ERROR Exiting Kafka. (kafka.server.KafkaServerStartable)
[2018-07-25 12:22:27,177] INFO shutting down (kafka.server.KafkaServer)

答案1

jaas 文件格式对我来说并不完全清楚，无论如何，最终对我有用的是使用客户端和服务器 jaas 文件的所有用户/密码格式

Client {
    org.apache.zookeeper.server.auth.DigestLoginModule required
    username="admin"
    password="admin-pass"
    user_admin="admin";
};

相关内容