[KAFKA-5801] Use hadoop.security.auth_to_local if available

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.10.0.0, 0.11.0.0
• Labels: authentication authorization kerberos sasl security
• Environment: hadoop 2.6
• Assignee: Unassigned
• Reporter: Ruslan Dautkhanov
• Created: 28/Aug/17 16:22
• Updated: 28/Oct/17 15:39

Description

As discussed in comments for KAFKA-5764, would be great if Kafka would optionally use `hadoop.security.auth_to_local` whenever available and fallback to `sasl.kerberos.principal.to.local.rules` if `hadoop.security.auth_to_local` isn't set / isn't available.

We have so many components use `hadoop.security.auth_to_local` - including hdfs, yarn, hive, spark, impala and it seems that we would need to duplicate `auth_to_local` rules into Kafka config. We have a lot of rules in `hadoop.security.auth_to_local` so it would be much easier to maintain if it's in one place.

Issue Links

• is blocked by: KAFKA-5764 KafkaShortnamer should allow for case-insensitive matches