kafka开启kerberos,报错server not found in kerberos database

kafka开启了SASL(kerberos), server.properties配置为

sasl.enabled.mechanisms: GSSAPI
security.inter.broker.protocol: SASL_PLAINTEXT
ssl.mode.enable: false
allow.everyone.if.no.acl.found: true
sasl.port: 19092

服务端的jaas.conf内容为

KafkaServer {
com.sun.security.auth.module.Krb5LoginModule required
debug=false
keyTab="/opt/kafka/keytabs/kafka.keytab"
useTicketCache=false
storeKey=true
principal="kafka/hadoop.test.com@TEST.COM"
useKeyTab=true;
};KafkaClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/opt/kafka/keytabs/kafka.keytab"
principal="kafka/hadoop.test.com@TEST.COM"
storeKey=true
debug=false
useTicketCache=false;
};Client {
com.sun.security.auth.module.Krb5LoginModule required
storeKey=true
principal="kafka/hadoop.test.com@TEST.COM"
useTicketCache=false
keyTab="/opt/kafka/keytabs/kafka.keytab"
debug=false
useKeyTab=true;
};

在客户端查询kafka集群中所有节点的API版本信息

kafka-broker-api-versions.sh --bootstrap-server  192.168.1.140:19092

报错

Request METADATA failed on brokers List

这是因为客户端没有开启SASL
编辑client.properties

sasl.mechanism=GSSAPI
security.protocol=SASL_PLAINTEXT
sasl.kerberos.service.name=kafka
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \useKeyTab=true \storeKey=true \keyTab="/opt/kafkaclient/keytabs/kafka.keytab" \principal="kafka/hadoop.test.com@TEST.COM" \renewTGT=true \useTicketCache=true;

运行命令

kafka-broker-api-versions.sh --bootstrap-server  192.168.1.140:19092 --command-config client.properties

报错

no vailid crdentials provided
server not found in kerberos database
identifier doesn't match expected value

查看kerberos的日志krb5kdc.log

LOOKING_UP_SERVER: kafka@TEST.COM for kafka/test.com@TEST.COM,Server not found in Kerberos database

发现是服务名不对,正确的服务名是: kafka/hadoop.test.com@TEST.COM

修改client.properties

sasl.mechanism=GSSAPI
security.protocol=SASL_PLAINTEXT
sasl.kerberos.service.name=kafka
kerberos.domain.name=hadoop.test.com
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \useKeyTab=true \storeKey=true \keyTab="/opt/kafkaclient/keytabs/kafka.keytab" \principal="kafka/hadoop.test.com@TEST.COM" \renewTGT=true \useTicketCache=true;

再次运行

kafka-broker-api-versions.sh --bootstrap-server 192.168.1.140:19092 --command-config client.properties

可获得正确的结果

principal的主机名

查看kerberos的日志krb5kdc.log,如果报错

LOOKING_UP_SERVER: kafka/hadoop.test.com@TEST.COM for kafka/w120pc05@TEST.COM

可知是反解析hosts里的ip得到hostname,从而构建service principal;
principal的格式为primary/hostname@REALM

因此,另一种解决方法是,修改/etc/hosts

192.168.1.140 hadoop.test.com

kafka开启kerberos,报错server not found in kerberos database相关推荐

kafka创建topic报错
kafka创建topic报错 kafka-topics.sh \ --zookeeper mypc01:2181,mypc02:2181,mypc03:2181/kafka-2020 \ --crea ...
关于eclipse中web项目tomcat报错Server Tomcat v9.0 Server at localhost failed to start问题解决
第一次写博客,写个简单的好了关于eclipse中web项目tomcat报错Server Tomcat v9.0 Server at localhost failed to start 问题我的解决 ...
安装kerberos报错 error: command 'gcc' failed with exit status 1
pip install kerberos 报错:error: command 'gcc' failed with exit status 1 安装环境工具 yum install gcc libffi ...
Neo4j 启动报错 Server shutdown initiated by request
Neo4j 启动报错 Server shutdown initiated by request 检查Neo4j conf文件尝试restart 删除database下所有数据检查Neo4j con ...
mdk arm开启FPU报错问题
问题描述: mdk使用arm complier v6 开启FPU报错问题. 问题分析: 如果是使用arm v5版本编译器,按照下述步骤进行配置,然后编译是没有问题的: 在C/C++选项卡中添加下列宏定 ...
IDEA 配置连接数据库报错 Server returns invalid timezone. Need to set ‘serverTimezone‘ property.
项目场景: 提示:使用IDEA连接数据库: 问题描述提示:IDEA 配置连接数据库报错 Server returns invalid timezone. Need to set 'serverTim ...
kafka完美解决报错:Error while executing topic command:Replication factor:3 larger than available brokers:0
kafka完美解决报错:Error while executing topic command:Replication factor:3 larger than available brokers:0 ...
linux php没有启动,php报错开启_Linux开启PHP报错的方法
摘要腾兴网为您分享:Linux开启PHP报错的方法,中国人保,悦作业,小米社区,相机美颜等软件知识,以及alcoin,蓝光mp3剪切器,4,wav,乌兰察布招聘网,驾考系统,海管家,杀毒管家,lr视 ...
云服务器(阿里云)安装kafka及相关报错处理（WARN Connection request from old client /58.247.201.56:31365； will be dropp）
linux下载:wget http://mirrors.hust.edu.cn/apache/kafka/2.0.0/kafka_2.12-2.0.0.tgz 云服务器安装kafka,部署zookee ...
kafka启动内存报错There is insufficient memory for the Java Runtime Environment to continue
1.具体报错信息 OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from ...

kafka开启kerberos,报错server not found in kerberos database

principal的主机名

kafka开启kerberos,报错server not found in kerberos database相关推荐

最新文章

热门文章