[AMBARI-17479] authorizer.class.name not being set on secure kafka clusters

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.4.0
• Fix Version/s: 2.4.0
• Component/s: ambari-server
• Labels: kerberos kerberos_descriptor stack_advisor
• Assignee: Robert Levas
• Reporter: Robert Levas
• Due: 30/Jun/16
• Created: 29/Jun/16 13:37
• Updated: 07/Jul/16 21:31
• Resolved: 07/Jul/16 16:08

Description

The kafka-broker/authorizer.class.name property is not being set properly when Kerberos is enabled.

The following logic should be followed:

if Kerberos is enabled
  if ranger-kafka-plugin-properties/ranger-kafka-plugin-enabled == yes
    set authorizer.class.name to "org.apache.ranger.authorization.kafka.authorizer.RangerKafkaAuthorizer"
  else
    set authorizer.class.name to "kafka.security.auth.SimpleAclAuthorizer"
else
  remove authorizer.class.name

This should be updated in the stack advisor code.

While at it, configurations from Kafka's kerberos.json file should be moved to the stack advisor to help ensure properties are set in the the same place to help with code maintenance and consistency.

Issue Links

• is duplicated by: AMBARI-17477 authorizer.class.name not being set on secure kafka clusters
• is duplicated by: AMBARI-17478 authorizer.class.name not being set on secure kafka clusters
• links to: ReviewBoard