How to use SASL_PLAINTEXT (Kerberos) with Burrow #584

apellegr06 · 2019-11-15T15:25:05Z

Is it possible to use SASL_PLAINTEXT (Kerberos) with Burrow and if yes how to configure the jaas file path ?

trijimonpr · 2019-12-02T11:43:19Z

Hi @apellegr06 - I have been trying to setup SASL_SSL with no luck far, but I think the configuration below should work for plaintext.

`[sasl.mysasl]
username="jass_username"
password="jaas_password"

[client-profile.test]
client-id="burrow-test"
kafka-version="0.10.2.1"
sasl="mysasl"`

iMajna · 2020-02-22T15:28:28Z

There is no documentation about connecting to Kafka with keytabs or using sasl.mechanism GSSAPI. Although there is no documentation I can see following issue which is closed: #204 and reference here #283. This means that in Burrow 1.0 this communication should be possible.

@toddpalino is it possible to confirm this? Would be grateful :)

patelprakashp · 2020-03-13T22:32:27Z

@toddpalino - I would also like to know that do we support Kafka with keytabs or using sasl.mechanism GSSAP , If yes is there documentation or sample we can follow to specify keytab file. @iMajna @trijimonpr @apellegr06 - if you have any details please forward to me.

patelprakashp · 2020-03-13T22:35:02Z

@bai @timbertson - Do guys have any update here ? thanks..

chaoqun-wu · 2020-04-27T06:57:57Z

I am a Go noob,and I tried to use SASL_PLAINTEXT (Kerberos) with Burrow. I tried to use this patch：

diff --git a/core/internal/helpers/sarama.go b/core/internal/helpers/sarama.go
index d216b94..d45ec29 100644
--- a/core/internal/helpers/sarama.go
+++ b/core/internal/helpers/sarama.go
@@ -129,6 +129,25 @@ func GetSaramaConfigFromClientProfile(profileName string) *sarama.Config {
                saramaConfig.Net.SASL.Password = viper.GetString("sasl." + saslName + ".password")
        }

+       // Configure kerberos if enabled
+       if viper.IsSet(configRoot + ".kerberos") {
+               saslName := viper.GetString(configRoot + ".kerberos")
+               saramaConfig.Net.SASL.Enable = true
+
+               saramaConfig.Net.SASL.Mechanism = sarama.SASLTypeGSSAPI
+               saramaConfig.Net.SASL.GSSAPI.AuthType = sarama.KRB5_KEYTAB_AUTH
+               //sasl.kerberos.service.name
+               saramaConfig.Net.SASL.GSSAPI.ServiceName = viper.GetString("kerberos." + saslName + ".servicename")
+               //krb5.conf
+               saramaConfig.Net.SASL.GSSAPI.KerberosConfigPath = viper.GetString("kerberos." + saslName + ".krb5")
+               //realm
+               saramaConfig.Net.SASL.GSSAPI.Realm = viper.GetString("kerberos." + saslName + ".realm")
+               //keytab
+               saramaConfig.Net.SASL.GSSAPI.KeyTabPath = viper.GetString("kerberos." + saslName + ".keytab")
+               //username
+               saramaConfig.Net.SASL.GSSAPI.Username = viper.GetString("kerberos." + saslName + ".username")
+       }
+
        return saramaConfig
 }

and this is my Burrow config for Kerberos

[client-profile.myclient] #this client profile name is myclient
kafka-version="2.2.1"    #kafka server version
client-id="burrow-myclient" # a string to be passed to kafka as client Id
kerberos="myclient"

[kerberos.myclient]
servicename="kafka"
krb5="/etc/krb5.conf"
realm="SIT"
keytab="/root/kafka.keytab"
username="kafka"

I modified krb5.conf because of this

##krb5.conf
default_tkt_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
default_tgs_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
permitted_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
udp_preference_limit = 1

Retrieving the appropriate tickets seems to go without any issues. However, when this function is executed I get some trouble.Here is which line throw EOF exception.

Logs：

{"level":"debug","ts":1587689029.6086605,"msg":"Error while performing GSSAPI Kerberos Authentication: EOF","name":"sarama"}

Maybe these can help.

IBM/sarama#1526

IBM/sarama#1658

alexanderdehes · 2020-05-01T06:48:29Z

I think the problem is that a raw GSSAPI request (GSS_API_INITIAL )is sent to the broker which is rejected because it is not encapsulated in a kafka protocol header. As the broker does not reply, you get an EOF.
GSSAPI support for broker V1.0.0 and higher is not working because of this.

ghost · 2020-05-28T09:49:14Z

Have anyone found a workaround as yet?

tanuj83 · 2020-10-14T07:34:14Z

are we ready for SASL_SSL (kerberos)

chaoqun-wu · 2020-11-09T07:35:50Z

I am a Go noob,and I tried to use SASL_PLAINTEXT (Kerberos) with Burrow. I tried to use this patch：

diff --git a/core/internal/helpers/sarama.go b/core/internal/helpers/sarama.go
index d216b94..d45ec29 100644
--- a/core/internal/helpers/sarama.go
+++ b/core/internal/helpers/sarama.go
@@ -129,6 +129,25 @@ func GetSaramaConfigFromClientProfile(profileName string) *sarama.Config {
                saramaConfig.Net.SASL.Password = viper.GetString("sasl." + saslName + ".password")
        }

+       // Configure kerberos if enabled
+       if viper.IsSet(configRoot + ".kerberos") {
+               saslName := viper.GetString(configRoot + ".kerberos")
+               saramaConfig.Net.SASL.Enable = true
+
+               saramaConfig.Net.SASL.Mechanism = sarama.SASLTypeGSSAPI
+               saramaConfig.Net.SASL.GSSAPI.AuthType = sarama.KRB5_KEYTAB_AUTH
+               //sasl.kerberos.service.name
+               saramaConfig.Net.SASL.GSSAPI.ServiceName = viper.GetString("kerberos." + saslName + ".servicename")
+               //krb5.conf
+               saramaConfig.Net.SASL.GSSAPI.KerberosConfigPath = viper.GetString("kerberos." + saslName + ".krb5")
+               //realm
+               saramaConfig.Net.SASL.GSSAPI.Realm = viper.GetString("kerberos." + saslName + ".realm")
+               //keytab
+               saramaConfig.Net.SASL.GSSAPI.KeyTabPath = viper.GetString("kerberos." + saslName + ".keytab")
+               //username
+               saramaConfig.Net.SASL.GSSAPI.Username = viper.GetString("kerberos." + saslName + ".username")
+       }
+
        return saramaConfig
 }

and this is my Burrow config for Kerberos

[client-profile.myclient] #this client profile name is myclient
kafka-version="2.2.1"    #kafka server version
client-id="burrow-myclient" # a string to be passed to kafka as client Id
kerberos="myclient"

[kerberos.myclient]
servicename="kafka"
krb5="/etc/krb5.conf"
realm="SIT"
keytab="/root/kafka.keytab"
username="kafka"

I modified krb5.conf because of this

##krb5.conf
default_tkt_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
default_tgs_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
permitted_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
udp_preference_limit = 1

Retrieving the appropriate tickets seems to go without any issues. However, when this function is executed I get some trouble.Here is which line throw EOF exception.

Logs：

{"level":"debug","ts":1587689029.6086605,"msg":"Error while performing GSSAPI Kerberos Authentication: EOF","name":"sarama"}

Maybe these can help.

Shopify/sarama#1526

Shopify/sarama#1658

I am a Go noob,and I tried to use SASL_PLAINTEXT (Kerberos) with Burrow. I tried to use this patch：

diff --git a/core/internal/helpers/sarama.go b/core/internal/helpers/sarama.go
index d216b94..d45ec29 100644
--- a/core/internal/helpers/sarama.go
+++ b/core/internal/helpers/sarama.go
@@ -129,6 +129,25 @@ func GetSaramaConfigFromClientProfile(profileName string) *sarama.Config {
                saramaConfig.Net.SASL.Password = viper.GetString("sasl." + saslName + ".password")
        }

+       // Configure kerberos if enabled
+       if viper.IsSet(configRoot + ".kerberos") {
+               saslName := viper.GetString(configRoot + ".kerberos")
+               saramaConfig.Net.SASL.Enable = true
+
+               saramaConfig.Net.SASL.Mechanism = sarama.SASLTypeGSSAPI
+               saramaConfig.Net.SASL.GSSAPI.AuthType = sarama.KRB5_KEYTAB_AUTH
+               //sasl.kerberos.service.name
+               saramaConfig.Net.SASL.GSSAPI.ServiceName = viper.GetString("kerberos." + saslName + ".servicename")
+               //krb5.conf
+               saramaConfig.Net.SASL.GSSAPI.KerberosConfigPath = viper.GetString("kerberos." + saslName + ".krb5")
+               //realm
+               saramaConfig.Net.SASL.GSSAPI.Realm = viper.GetString("kerberos." + saslName + ".realm")
+               //keytab
+               saramaConfig.Net.SASL.GSSAPI.KeyTabPath = viper.GetString("kerberos." + saslName + ".keytab")
+               //username
+               saramaConfig.Net.SASL.GSSAPI.Username = viper.GetString("kerberos." + saslName + ".username")
+       }
+
        return saramaConfig
 }

and this is my Burrow config for Kerberos

[client-profile.myclient] #this client profile name is myclient
kafka-version="2.2.1"    #kafka server version
client-id="burrow-myclient" # a string to be passed to kafka as client Id
kerberos="myclient"

[kerberos.myclient]
servicename="kafka"
krb5="/etc/krb5.conf"
realm="SIT"
keytab="/root/kafka.keytab"
username="kafka"

I modified krb5.conf because of this

##krb5.conf
default_tkt_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
default_tgs_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
permitted_enctypes = aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 des-cbc-md5 des-cbc-crc des3-cbc-sha1
udp_preference_limit = 1

Retrieving the appropriate tickets seems to go without any issues. However, when this function is executed I get some trouble.Here is which line throw EOF exception.

Logs：

{"level":"debug","ts":1587689029.6086605,"msg":"Error while performing GSSAPI Kerberos Authentication: EOF","name":"sarama"}

Maybe these can help.

Shopify/sarama#1526

Shopify/sarama#1658

Update sarama with a fix for #1697 , I can use SASL_PLAINTEXT (Kerberos) with Burrow now.

mihaitodor mentioned this issue Oct 23, 2023

Whether kafka supports kerberos authentication redpanda-data/connect#2175

Closed

mihaitodor mentioned this issue Nov 9, 2023

Support kerberos auth in kafka components redpanda-data/connect#877

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to use SASL_PLAINTEXT (Kerberos) with Burrow #584

How to use SASL_PLAINTEXT (Kerberos) with Burrow #584

apellegr06 commented Nov 15, 2019

trijimonpr commented Dec 2, 2019

iMajna commented Feb 22, 2020

patelprakashp commented Mar 13, 2020

patelprakashp commented Mar 13, 2020

chaoqun-wu commented Apr 27, 2020 •

edited

Loading

alexanderdehes commented May 1, 2020

ghost commented May 28, 2020

tanuj83 commented Oct 14, 2020

chaoqun-wu commented Nov 9, 2020

How to use SASL_PLAINTEXT (Kerberos) with Burrow #584

How to use SASL_PLAINTEXT (Kerberos) with Burrow #584

Comments

apellegr06 commented Nov 15, 2019

trijimonpr commented Dec 2, 2019

iMajna commented Feb 22, 2020

patelprakashp commented Mar 13, 2020

patelprakashp commented Mar 13, 2020

chaoqun-wu commented Apr 27, 2020 • edited Loading

alexanderdehes commented May 1, 2020

ghost commented May 28, 2020

tanuj83 commented Oct 14, 2020

chaoqun-wu commented Nov 9, 2020

chaoqun-wu commented Apr 27, 2020 •

edited

Loading