Kafka adding SASL users dynamically without cluster restart

Question

We want to add authentication to our kafka cluster by using SASL. As we see that we want to be able to frequently add users we are looking for at way to do this without having to perform a rolling restart.

What we have tried:

Using the Dynamic Broker Configuration interface, reconfiguring listener.name.sasl_plaintext.plain.sasl.jaas.config for all brokers.

The kafka brokers pick up on the change in zookeeper [2019-01-11 11:08:23,403] INFO Processing override for entityPath: brokers/1 with config: Map(listener.name.sasl_plaintext.plain.sasl.jaas.config -> encryptedPassword:XXX,keyLength:128,cipherAlgorithm:AES/CBC/PKCS5Padding,initializationVector:YYY,keyFactoryAlgorithm:PBKDF2WithHmacSHA512,salt:ZZZ,iterations:4096,passwordLength:270) (kafka.server.DynamicConfigManager)

However new users are not able to connect until the broker is restarted.

Is it possible to add new users to the SASL JAAS configuration without restarting the Kafka cluster?

Which version of Kafka you are using? – Steephen Jan 11 '19 at 18:02 — Steephen, Jan 11 '19 at 18:02

score 5 · Accepted Answer · answered Jan 12 '19 at 10:38

5

If you are using plain mechanism in sasl_plaintext, Based on this answer you're not able to add a new user in a running cluster.

instead, you can switch to SCRAM mechanism and after that, you'll be able to create a user in running cluster with a command like this:

$ > bin/kafka-configs.sh --zookeeper localhost:2181 --alter --add-config 'SCRAM-SHA-256=[iterations=8192,password=alice-secret],SCRAM-SHA-512=[password=alice-secret]' --entity-type users --entity-name alice

However, you still need to keep JAAS config file but, you just pass it once when starting the server.

Here is a useful link in Kafka document about using SCRAM mechanism.

answered Jan 12 '19 at 10:38

Amin

975
8
24

Thanks! We will be looking in that direction – DagW Jan 17 '19 at 12:38
I think you should remove the quotes from the config section after --add-config. – Ismail Sep 13 '19 at 14:25
@M.Ismail based on the Kafka document link in the answer, it's necessary. – Amin Sep 14 '19 at 05:36
Is it possible to add tls to this? – James Forbes Feb 14 '21 at 23:40
Warning: --zookeeper is deprecated and will be removed in a future version of Kafka. – Rubatharisan Thirumathyam Nov 19 '21 at 11:12

Kafka adding SASL users dynamically without cluster restart

1 Answers1