jaas.conf 中未选取 KafkaClient 部分

Question

我正在尝试对 KafkaConsumer 使用 kerberos 身份验证。

为此，我添加了以下属性。

    props.put("security.protocol", "SASL_PLAINTEXT"); // Setting this means we try to look in jaas.conf

    props.put("sasl.kerberos.service.name", "kafka");

但是，我收到一条错误消息：

java.lang.IllegalArgumentException: Could not find a 'KafkaClient' entry in the JAAS configuration. System property 'java.security.auth.login.config' is /Users/jhutc/projects/molly/Monitor-Lizard-API/out/production/resources/hive_config/local/jaas.conf

完整错误：

Caused by: org.apache.kafka.common.KafkaException: Failed to construct kafka consumer

at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:799) ~[kafka-clients-2.0.0.jar:?]

at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:615) ~[kafka-clients-2.0.0.jar:?]

at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:596) ~[kafka-clients-2.0.0.jar:?]

at com.xxx.xx.moli.data.KafkaDataHelper.getConsumer(KafkaDataHelper.java:293) ~[classes/:?]

... 53 more

Caused by: java.lang.IllegalArgumentException: Could not find a 'KafkaClient' entry in the JAAS configuration. System property 'java.security.auth.login.config' is /Users/jhutc/projects/molly/Monitor-Lizard-API/out/production/resources/hive_config/local/jaas.conf

    at org.apache.kafka.common.security.JaasContext.defaultContext(JaasContext.java:133) ~[kafka-clients-2.0.0.jar:?]

    at org.apache.kafka.common.security.JaasContext.load(JaasContext.java:98) ~[kafka-clients-2.0.0.jar:?]

    at org.apache.kafka.common.security.JaasContext.loadClientContext(JaasContext.java:84) ~[kafka-clients-2.0.0.jar:?]

    at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:119) ~[kafka-clients-2.0.0.jar:?]

    at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:65) ~[kafka-clients-2.0.0.jar:?]

谁能解释为什么我收到错误，并且 KafkaClient 部分没有被选中？

（顺便说一句，jaas.conf 文件的第二部分已被正确选取用于应用程序的不同部分。）

Answer 1

JAAS 文件的准确语法可能很难正确掌握。每个 LoginModule 项之后以及每个块之后都需要分号。principal="[e-mail]"所以你可能在块后面缺少一个分号KafkaClient。但是，从 Kafka 0.10.2 开始，使用该sasl.jaas.config设置来配置客户端以使用 SASL 变得更加容易。例如：props.put("sasl.jaas.config", "com.sun.security.auth.module.Krb5LoginModule required " +    "useKeyTab=true " +    "storeKey=true " +    "keyTab=\"src/main/resources/hive_config/local/jhutc.keytab\" " +    "principal=\"[e-mail]\";");