我正在尝试将 kerberos 身份验证与 KafkaConsumer 一起使用。
为此，我添加了以下属性。
props.put("security.protocol", "SASL_PLAINTEXT"); // Setting this means we try to look in jaas.conf
props.put("sasl.kerberos.service.name", "kafka");
但是，我收到一个错误，说：
java.lang.IllegalArgumentException: Could not find a 'KafkaClient' entry in the JAAS configuration. System property 'java.security.auth.login.config' is /Users/jhutc/projects/molly/Monitor-Lizard-API/out/production/resources/hive_config/local/jaas.conf
完全错误：
Caused by: org.apache.kafka.common.KafkaException: Failed to construct kafka consumer
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:799) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:615) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:596) ~[kafka-clients-2.0.0.jar:?]
at com.xxx.xx.moli.data.KafkaDataHelper.getConsumer(KafkaDataHelper.java:293) ~[classes/:?]
... 53 more
Caused by: java.lang.IllegalArgumentException: Could not find a 'KafkaClient' entry in the JAAS configuration. System property 'java.security.auth.login.config' is /Users/jhutc/projects/molly/Monitor-Lizard-API/out/production/resources/hive_config/local/jaas.conf
at org.apache.kafka.common.security.JaasContext.defaultContext(JaasContext.java:133) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.common.security.JaasContext.load(JaasContext.java:98) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.common.security.JaasContext.loadClientContext(JaasContext.java:84) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:119) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:65) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:88) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:713) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:615) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:596) ~[kafka-clients-2.0.0.jar:?]
at com.xxx.xx.moli.data.KafkaDataHelper.getConsumer(KafkaDataHelper.java:293) ~[classes/:?]
... 53 more
我的jaas.conf看起来像这样：
KafkaClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
keyTab="src/main/resources/hive_config/local/jhutc.keytab"
principal="jhutc@AD.company.COM"
};
com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
keyTab="src/main/resources/hive_config/local/jhutc.keytab"
principal="jhutc@AD.company.COM"
debug=true;
};
谁能解释为什么我收到错误，并且没有选择KafkaClient部分？
(顺便说一下，jaas.conf 文件的第二部分正在为应用程序的不同部分正确选取。
JAAS 文件的确切语法可能很难正确。您需要在每个登录模块项之后以及每个块之后使用分号。因此，在KafkaClient块中principal="jhutc@AD.company.COM"后，您可能会缺少分号。
但是，从 Kafka 0.10.2 开始，使用sasl.jaas.config设置将客户端配置为使用 SASL 变得更加容易。
该文档有一个如何配置它的部分：http://kafka.apache.org/documentation/#security_sasl_kerberos_clientconfig
例如：
props.put("sasl.jaas.config", "com.sun.security.auth.module.Krb5LoginModule required " +
"useKeyTab=true " +
"storeKey=true " +
"keyTab="src/main/resources/hive_config/local/jhutc.keytab" " +
"principal="jhutc@AD.company.COM";");