[KAFKA-6198] kerberos login fails

• Type: Test
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.11.0.1
• Component/s: clients
• Environment: raspberrypi
• Assignee: Unassigned
• Reporter: Ronald van de Kuil
• Created: 10/Nov/17 11:56
• Updated: 10/Nov/17 13:10
• Resolved: 10/Nov/17 13:10

Description

I got very far with setting up kerberos on the raspberry pi as part of self study.

I believe that the kafka server is happy with kerberos:

[2017-11-10 12:17:51,659] INFO Successfully authenticated client: authenticationID=kafka/[e-mail]; authorizationID=kafka/[e-mail]. (org.apache.kafka.common.security.authenticator.SaslServerCallbackHandler)
[2017-11-10 12:17:51,661] INFO Setting authorizedID: kafka (org.apache.kafka.common.security.authenticator.SaslServerCallbackHandler)

I have setup the kafka.security.auth.SimpleAclAuthorizer

And granted the following access:

Current ACLs for resource `Topic:kerberos-topic`:
User:producer has Allow permission for operations: Describe from hosts: *
User:producer has Allow permission for operations: Write from hosts: *
User:[e-mail] has Allow permission for operations: Describe from hosts: *
User:[e-mail] has Allow permission for operations: Write from hosts: *

When I start the client, then I see it getting the kerberos ticket:

[main] INFO org.apache.kafka.common.security.authenticator.AbstractLogin - Successfully logged in.
[[e-mail]] INFO org.apache.kafka.common.security.kerberos.KerberosLogin - [Principal=[e-mail]]: TGT refresh thread started.
[[e-mail]] INFO org.apache.kafka.common.security.kerberos.KerberosLogin - [Principal=[e-mail]]: TGT valid starting at: Fri Nov 10 12:50:11 CET 2017
[[e-mail]] INFO org.apache.kafka.common.security.kerberos.KerberosLogin - [Principal=[e-mail]]: TGT expires: Fri Nov 10 22:50:11 CET 2017
[[e-mail]] INFO org.apache.kafka.common.security.kerberos.KerberosLogin - [Principal=[e-mail]]: TGT refresh sleeping until: Fri Nov 10 21:13:37 CET 2017

But the client fails to login:

[kafka-producer-network-thread | producer-1] WARN org.apache.kafka.clients.NetworkClient - Connection to node -1 terminated during authentication. This may indicate that authentication failed due to invalid credentials.

I do not see any warnings in the logs, so I do not have much to go on.

What can I do to get my finger behind this issue?

Thank you,

Ronald - the NOOB