Kerberos Kafka consumer setup

August 6, 2022

What's inside this article ⌄

Kafka Kerberos consumer Java
How to setup Kafka Kerberos client
Kafka secure consumer configuration
Kafka authentication Kerberos Java

Suppose that you need to create Kafka Java consumer with Kerberos. The code will be:

 1public KafkaConsumer<String, String> createKafkaKerberosConsumer(String groupID) {
 2    Properties props = new Properties();
 3    props.put(ConsumerConfig.BOOTSTRAP_SERVERS_CONFIG, "localhost:3991");
 4    props.put(ConsumerConfig.GROUP_ID_CONFIG, groupID);
 5    props.put(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, "SASL_PLAINTEXT");
 6    props.put(SaslConfigs.SASL_KERBEROS_SERVICE_NAME, "HTTP");
 7    props.put(SaslConfigs.SASL_JAAS_CONFIG, kafkaJaasConfiguration());
 8    props.put(ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG, StringDeserializer.class.getName());
 9    props.put(ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG, StringDeserializer.class.getName());
10    return new KafkaConsumer<String, String>(props);
11}
12
13private String kafkaJaasConfiguration() {
14    return "com.sun.security.auth.module.Krb5LoginModule required " +
15            "useKeyTab=true " +
16            "keyTab=\"/path/to/keytab/name.keytab\" " +
17            "storeKey=false " +
18            "debug=false " +
19            "principal=\"userprincipal@REALM\";";
20}

You don’t need to specify java.security.auth.login.config Java property, because we set SaslConfigs.SASL_JAAS_CONFIG property directly to the consumer.

You need to make changes in kafkaJaasConfiguration() method that necessary for your Kerberos configuration.

Kafka Broker Kerberos configuration can be set according to this article.