0

I have read the documentation on Kafka security here: https://kafka.apache.org/documentation/#security_authz_cli

and I was wondering something about the ports they use. For the authentication portion, under 7.2 Encryption and authentication using SSL, they have the statement:

kafka-console-producer.sh --broker-list localhost:9093 --topic test --producer.config client-ssl.properties
kafka-console-consumer.sh --bootstrap-server localhost:9093 --topic test --consumer.config client-ssl.properties

for the use cases of the console consumer and producer.

For the authorization portion, under 7.4 Authorizations and ACL, when showing on how to add to ACLs different permissions for different users, they have the phase:

bin/kafka-acls.sh --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:Bob --allow-principal User:Alice --allow-host 198.51.100.0 --allow-host 198.51.100.1 --operation Read --operation Write --topic Test-topic

So my question is, for the "broker-list" and "bootstrap-server" variable in the authentication portion and the "zookeeper.connect" variable in authorization, does the port and localhost have the be the same? It isn't in the examples given and I'm trying to combine the authentication and authorization parts using SSL. Is they need to be the same or do not need to be the same, why? Any documentation / tutorial on how to do this using purely console only is appreciated. I don't want to use Kerebos.

tom dinh
  • 143
  • 1
  • 4
  • 13
  • 1
    Authentication is done against Kafka Broker, 9093 is the KB default port when using TLS. Authorization information is stored in Zookeeper server, ZK default port is 2181. These are different processes (servers) so the ports MUST be different. In most real-life cases, the hostnames will be different also. – mazaneicha Sep 24 '19 at 16:03
  • So if I combined these 2 parts together, will it be able to function as expected when it comes to authenticating the user and authorizing them to do certain tasks? – tom dinh Sep 24 '19 at 16:11
  • 1
    Yes thats the idea. After producers and consumers authenticate with Kafka Broker, KB checks their authorization to perform any action against Zookeeper. – mazaneicha Sep 24 '19 at 16:17

0 Answers0