java - jaas.conf中未拾取KafkaClient部分

我正在尝试通过KafkaConsumer使用kerberos身份验证。

为此，我添加了以下属性。

    props.put("security.protocol", "SASL_PLAINTEXT"); // Setting this means we try to look in jaas.conf
    props.put("sasl.kerberos.service.name", "kafka");

但是，我收到一条错误消息：

java.lang.IllegalArgumentException: Could not find a 'KafkaClient' entry in the JAAS configuration. System property 'java.security.auth.login.config' is /Users/jhutc/projects/molly/Monitor-Lizard-API/out/production/resources/hive_config/local/jaas.conf

完整错误：

Caused by: org.apache.kafka.common.KafkaException: Failed to construct kafka consumer
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:799) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:615) ~[kafka-clients-2.0.0.jar:?]
at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:596) ~[kafka-clients-2.0.0.jar:?]
at com.xxx.xx.moli.data.KafkaDataHelper.getConsumer(KafkaDataHelper.java:293) ~[classes/:?]
... 53 more
Caused by: java.lang.IllegalArgumentException: Could not find a 'KafkaClient' entry in the JAAS configuration. System property 'java.security.auth.login.config' is /Users/jhutc/projects/molly/Monitor-Lizard-API/out/production/resources/hive_config/local/jaas.conf
    at org.apache.kafka.common.security.JaasContext.defaultContext(JaasContext.java:133) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.common.security.JaasContext.load(JaasContext.java:98) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.common.security.JaasContext.loadClientContext(JaasContext.java:84) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:119) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:65) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:88) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:713) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:615) ~[kafka-clients-2.0.0.jar:?]
    at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:596) ~[kafka-clients-2.0.0.jar:?]
    at com.xxx.xx.moli.data.KafkaDataHelper.getConsumer(KafkaDataHelper.java:293) ~[classes/:?]
    ... 53 more

我的jaas.conf看起来像这样：

KafkaClient {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    storeKey=true
    keyTab="src/main/resources/hive_config/local/jhutc.keytab"
    principal="[email protected]"
};

com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    storeKey=true
    keyTab="src/main/resources/hive_config/local/jhutc.keytab"
    principal="[email protected]"
    debug=true;
};

谁能解释我为什么会收到错误消息，而没有找到KafkaClient部分？

（偶然地，jaas.conf文件的第二部分已为应用程序的不同部分正确地拾取。）

最佳答案

JAAS文件的确切语法可能很难理解。在每个LoginModule项目之后以及每个块之后，都需要使用半冒号。因此，您可能在principal="[email protected]"块中的KafkaClient之后缺少分号。

但是，从Kafka 0.10.2开始，使用sasl.jaas.config设置将客户端配置为使用SASL更容易。

文档中有一节如何配置它：http://kafka.apache.org/documentation/#security_sasl_kerberos_clientconfig

例如：

props.put("sasl.jaas.config", "com.sun.security.auth.module.Krb5LoginModule required " +
    "useKeyTab=true " +
    "storeKey=true " +
    "keyTab=\"src/main/resources/hive_config/local/jhutc.keytab\" " +
    "principal=\"[email protected]\";");