Kafka权限配置

参考官网链接：

http://kafka.apache.org/22/documentation.html#security_sasl

此处使用的是权限方式是SASL/SCRAM-SHA-256 and SASL/SCRAM-SHA-512

需要注意的是这个方式：starting at version 0.10.2.0

使用SASL/SCRAM的原因是在不用关闭kafka的情况下可以动态的添加用户读写权限

本文章以apache2.2.0举例，单机版。

操作步骤:

1、zookeeper上创建用户

生产者：写权限

bin/kafka-configs.sh --zookeeper localhost:2183 \
--alter --add-config 'SCRAM-SHA-256=[iterations=8192,password=prod-sec],SCRAM-SHA-512=[password=prod-sec]' \
--entity-type users --entity-name producer

消费者：读权限

bin/kafka-configs.sh --zookeeper localhost:2183 --alter  \
--add-config 'SCRAM-SHA-256=[iterations=8192,password=cons-sec],SCRAM-SHA-512=[password=cons-sec]' \
--entity-type users --entity-name consumer

admin用户用于broker之间的通讯
bin/kafka-configs.sh --zookeeper localhost:2183 --alter \
--add-config 'SCRAM-SHA-256=[password=admin-secret],SCRAM-SHA-512=[password=admin-secret]'\
 --entity-type users --entity-name admin

2、修改kafka的配置文件

配置kafka-broker-jaas.conf
KafkaServer {
org.apache.kafka.common.security.scram.ScramLoginModule required
username="admin"
password="admin-secret";
};

编辑: 后台启动脚本kafka-server-start.sh
#exec $base_dir/kafka-run-class.sh $EXTRA_ARGS kafka.Kafka "$@"
exec $base_dir/kafka-run-class.sh $EXTRA_ARGS -Djava.security.auth.login.config=/opt/kafka/kafka-9091/kafka/config/kafka-broker-jaas.conf  kafka.Kafka "$@"

2、配置server.properties
allow.everyone.if.no.acl.found=false
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
super.users=User:admin
sasl.enabled.mechanisms=SCRAM-SHA-512
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-512
security.inter.broker.protocol=SASL_PLAINTEXT

#和listeners机制保持一致SASL_PLAINTEXT
advertised.listeners=SASL_PLAINTEXT://localhost:9093

编辑消费者
在consumer.conf中添加:
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="consumer" password="cons-sec";

编辑生产者
在consumer.conf中添加:
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="producer" password="pro-sec";

3、启动kafka:
cd $KAFKA_HOME/
nohup bin/kafka-server-start.sh config/server.properties & tail -f nohup.out

 

4、创建topic并且给用户授权:
$KAFKA_HOME/bin/kafka-topics.sh --create --zookeeper localhost:2181  --replication-factor 1 --partitions 1 --topic test1

$KAFKA_HOME/bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:consumer  --operation Read --topic test1
$KAFKA_HOME/bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:producer --operation Write --topic test1

5、给组授权

$KAFKA_HOME/bin/kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:consumer --operation Read --group group1

 

生产：
$KAFKA_HOME/bin/kafka-console-producer.sh --broker-list locahost:9093 --topic  test1  --producer.config $KAFKA_HOME/config/producer.conf
消费:
$KAFKA_HOME/kafka/bin/kafka-console-consumer.sh --bootstrap-server  localhost:9093 --topic test1--group group1--consumer.config $KAFKA_HOME/config/consumer.conf