Kerberos Kafka broker setup

Let’s see how we can configure Kerberos between Kafka broker and Kafka client on the server side. For the client configuration see explore another article.

<kafka_home>/conf/server.properties

advertised.listeners=SASL_PLAINTEXT://:3090
listeners=SASL_PLAINTEXT://:3090
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=GSSAPI
sasl.enabled.mechanisms=GSSAPI
sasl.kerberos.service.name=HTTP

<kafka_home>/bin/kafka-run-class.sh

Insert this:

-Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=/path/to/kafka_server_jaas.conf

To KAFKA_OPTS:

# Generic jvm settings you want to add
if [ -z "$KAFKA_OPTS" ]; then
KAFKA_OPTS=""
fi

Result:

# Generic jvm settings you want to add
if [ -z "$KAFKA_OPTS" ]; then
KAFKA_OPTS="-Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=/your/path/to/kafka_server_jaas.conf"
fi

/your/path/to/kafka_server_jaas.conf

KafkaServer {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  storeKey=true
  debug=false
  keyTab="/path/to/keytab/file.keytab"
  principal="HTTP/host@REALM";
};

Kerberos between Kafka brokers is configuring with separate conf keys (which we are not mentioned in this article).

The above configuration is for broker-client interaction.

Kafka Consumer/Producer Kerberos configuration can be set according to this article.