kafka開啟了SASL(kerberos), server.properties配置為

sasl.enabled.mechanisms: GSSAPI security.inter.broker.protocol: SASL_PLAINTEXT ssl.mode.enable: false allow.everyone.if.no.acl.found: true sasl.port: 19092

服務端的jaas.conf內容為

KafkaServer { com.sun.security.auth.module.Krb5LoginModule required debug=false keyTab="/opt/kafka/keytabs/kafka.keytab" useTicketCache=false storeKey=true principal="kafka/hadoop.test.com@TEST.COM" useKeyTab=true; };KafkaClient { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="/opt/kafka/keytabs/kafka.keytab" principal="kafka/hadoop.test.com@TEST.COM" storeKey=true debug=false useTicketCache=false; };Client { com.sun.security.auth.module.Krb5LoginModule required storeKey=true principal="kafka/hadoop.test.com@TEST.COM" useTicketCache=false keyTab="/opt/kafka/keytabs/kafka.keytab" debug=false useKeyTab=true; };

在客戶端查詢kafka集群中所有節點的API版本信息

kafka-broker-api-versions.sh --bootstrap-server 192.168.1.140:19092

報錯

Request METADATA failed on brokers List

這是因為客戶端沒有開啟SASL
編輯client.properties

sasl.mechanism=GSSAPI security.protocol=SASL_PLAINTEXT sasl.kerberos.service.name=kafka sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \useKeyTab=true \storeKey=true \keyTab="/opt/kafkaclient/keytabs/kafka.keytab" \principal="kafka/hadoop.test.com@TEST.COM" \renewTGT=true \useTicketCache=true;

運行命令

kafka-broker-api-versions.sh --bootstrap-server 192.168.1.140:19092 --command-config client.properties

報錯

no vailid crdentials provided server not found in kerberos database identifier doesn't match expected value

查看kerberos的日志krb5kdc.log

LOOKING_UP_SERVER: kafka@TEST.COM for kafka/test.com@TEST.COM,Server not found in Kerberos database

發現是服務名不對,正確的服務名是: kafka/hadoop.test.com@TEST.COM

修改client.properties

sasl.mechanism=GSSAPI security.protocol=SASL_PLAINTEXT sasl.kerberos.service.name=kafka kerberos.domain.name=hadoop.test.com sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \useKeyTab=true \storeKey=true \keyTab="/opt/kafkaclient/keytabs/kafka.keytab" \principal="kafka/hadoop.test.com@TEST.COM" \renewTGT=true \useTicketCache=true;

再次運行

kafka-broker-api-versions.sh --bootstrap-server 192.168.1.140:19092 --command-config client.properties

可獲得正確的結果

principal的主機名

查看kerberos的日志krb5kdc.log,如果報錯

LOOKING_UP_SERVER: kafka/hadoop.test.com@TEST.COM for kafka/w120pc05@TEST.COM

可知是反解析hosts里的ip得到hostname,從而構建service principal;
principal的格式為primary/hostname@REALM

因此,另一種解決方法是,修改/etc/hosts

192.168.1.140 hadoop.test.com

總結

以上是生活随笔為你收集整理的kafka开启kerberos,报错server not found in kerberos database的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。