Kerberos is a network authentication protocol designed to provide strong authentication for client applications and server applications by using secret-key cryptography.
In Pulsar, you can use Kerberos with SASL as a choice for authentication. Since Pulsar uses the Java Authentication and Authorization Service (JAAS) for SASL configuration, you need to provide JAAS configurations for Kerberos authentication.
note
Kerberos authentication uses the authenticated principal as the role token for Pulsar authorization. If you've enabled authorizationEnabled, you need to set superUserRoles in broker.conf that corresponds to the name registered in KDC. For example:
Install a Kerberos server if your organization doesn't have one. Your Linux vendor might have packages for Kerberos. For how to install and configure Kerberos, see Ubuntu and
Redhat.
If you use Oracle Java, you need to download JCE policy files for your Java version and copy them to the $JAVA_HOME/jre/lib/security directory.
If you use the existing Kerberos system, ask your Kerberos administrator to obtain a principal for each broker in your cluster and for every operating system user that accesses Pulsar with Kerberos authentication (via clients and CLI tools).
If you have installed your own Kerberos system, you need to create these principals with the following commands:
The first part of broker principal (for example, broker in broker/{hostname}@{REALM}) is the serverType of each host. The suggested values of serverType are broker (host machine runs Pulsar broker service) and proxy (host machine runs Pulsar Proxy service).
Note that Kerberos requires that all your hosts can be resolved with their FQDNs.
In the broker.conf file, set Kerberos-related configurations. Here is an example:
authenticationEnabled=true authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderSasl saslJaasClientAllowedIds=.*client.* ## regex for principals that are allowed to connect to brokers saslJaasServerSectionName=PulsarBroker ## corresponds to the section in the JAAS configuration file for brokers # Authentication settings of the broker itself. Used when the broker connects to other brokers, or when the proxy connects to brokers, either in same or other clusters brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationSasl brokerClientAuthenticationParameters={"saslJaasClientSectionName":"PulsarClient", "serverType":"broker"}
To make Pulsar internal admin client work properly, you need to:
Set brokerClientAuthenticationPlugin to client plugin AuthenticationSasl;
Set brokerClientAuthenticationParameters to value in JSON string {"saslJaasClientSectionName":"PulsarClient", "serverType":"broker"}, in which PulsarClient is the section name in the pulsar_jaas.conf file, and "serverType":"broker" indicates that the internal admin client connects to a broker.
PulsarBroker is a section name in the JAAS file that each broker uses. This section tells the broker to use which principal inside Kerberos and the location of the keytab where the principal is stored.
PulsarClient is a section name in the JASS file that each client uses. This section tells the client to use which principal inside Kerberos and the location of the keytab where the principal is stored.
You need to set the pulsar_jaas.conf file path as a JVM parameter. For example:
If you want to use proxies between brokers and clients, Pulsar proxies (as a SASL server in Kerberos) will authenticate clients (as a SASL client in Kerberos) before brokers authenticate proxies.
To enable Kerberos authentication on proxies, complete the following steps.
In the proxy.conf file, set Kerberos-related configuration.
## related to authenticate client. authenticationEnabled=true authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderSasl saslJaasClientAllowedIds=.*client.* saslJaasServerSectionName=PulsarProxy ## related to be authenticated by broker brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationSasl brokerClientAuthenticationParameters={"saslJaasClientSectionName":"PulsarProxy", "serverType":"broker"} forwardAuthorizationCredentials=true
In the above example:
The first part relates to the authentication between clients and proxies. In this phase, clients work as SASL clients, while proxies work as SASL servers.
The second part relates to the authentication between proxies and brokers. In this phase, proxies work as SASL clients, while brokers work as SASL servers.
Configure Kerberos authentication in Java clients​
note
Ensure that the operating system user who starts Pulsar clients can access the keytabs configured in the pulsar_jaas.conf file and the KDC server configured in the krb5.conf file.
In client applications, include pulsar-client-auth-sasl in your project dependency.
Configure the authentication type to use AuthenticationSasl and provide the following parameters.
set saslJaasClientSectionName to PulsarClient;
set serverType to broker. serverType stands for whether this client connects to brokers or proxies. Clients use this parameter to know which server-side principal should be used.
The following is an example of configuring a Java client:
To configure clients for proxies, you need to set serverType to proxy instead of broker.
The first two lines in the above example are hard-coded. Alternatively, you can set additional JVM parameters for pulsar_jaas.conf and krb5.conf files when you run the application like below:
You can add this at the end of PULSAR_EXTRA_OPTS in the file pulsar_tools_env.sh, or add this line OPTS="$OPTS -Djava.security.auth.login.config=/etc/pulsar/pulsar_jaas.conf -Djava.security.krb5.conf=/etc/pulsar/krb5.conf" directly to the CLI tool script. The meaning of configurations is the same as the meaning of configurations in Java client section.
Configure Kerberos authentication between ZooKeeper and broker​
Pulsar broker acts as a Kerberos client when authenticating with Zookeeper.
SASLClientProviderFactory creates a BookKeeper SASL client in a broker, and the broker uses the created SASL client to authenticate with a Bookie node.
Add a section of BookKeeper configurations in the pulsar_jaas.conf file that broker/proxy uses.