Kafka SCRAM+ACL实现动态创建用户及权限控制

broker服务端

停止kafka

cd /app/kafka/bin
./kafka-server-stop.sh 

创建用户

# 获取zk连接信息
zk_conn=$(awk -F= '/^zookeeper.connect=/ {print $2}' /app/kafka/config/server.properties)

# 添加集群所需的用户
cd /app/kafka/bin
./kafka-configs.sh --zookeeper ${zk_conn} --alter --add-config 'SCRAM-SHA-512=[iterations=8192,password=admin-secret]' --entity-type users --entity-name admin
./kafka-configs.sh --zookeeper ${zk_conn} --alter --add-config 'SCRAM-SHA-512=[iterations=8192,password=ops-secret]' --entity-type users --entity-name ops

kafka集群通讯账号

cat <<'EOF' | tee -a /app/kafka/config/kafka_jaas.conf  > /dev/null

// broker之间使用的认证
KafkaServer {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="admin"
    password="admin-secret";
};

// 客户端连接Kafka的认证
KafkaClient {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="ops"
    password="ops-secret";
};
EOF

添加sasl和acl配置

sed -ri 's@^(listeners)=.*(://.*)@\1=SASL_PLAINTEXT\2@g' /app/kafka/config/server.properties

cat <<'EOF' | tee -a /app/kafka/config/server.properties > /dev/null

### SASL configuration begin ###
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-512
sasl.enabled.mechanisms=SCRAM-SHA-512
### SASL configuration begin ###

### ACL configuration end ###
allow.everyone.if.no.acl.found=false
super.users=User:admin;User:ops
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
### ACL configuration end ###
EOF

【建议】配置文件中 super.users 用户与 KafkaClient 用户一致，则可以少很多配置命令相关权限

Kafka启动脚本

# 复制匹配并注释该行
sed -ri '/^exec/h;/^exec/G;s/^(exec)/# \1/' /app/kafka/bin/kafka-server-start.sh
# 修改没有注释行
sed -ri 's@^(exec.*) (kafka\.)@\1 -Djava.security.auth.login.config=$(dirname $0)/../config/kafka_jaas.conf \2@' /app/kafka/bin/kafka-server-start.sh

注意：如果 -Djava.security.auth.login.config 使用与zookeeper改造sasl配置文件一致的话，则不需要修改启动脚本。反之，将最后一行注释掉，添加一行新的。

启动Kafka

cd /app/kafka/bin/
./kafka-server-start.sh -daemon ../config/server.properties

验证服务

# 过一段时间查看Kafka进程是否存在
$ jps
16306 Jps
12248 Kafka
10713 QuorumPeerMain

# 启动几个Kafka就有多少个节点
$ ./zkCli.sh -server 192.168.32.189:2181/kafka
[zk: 192.168.32.189:2181/kafka(CONNECTED) 0] ls /brokers/ids
[1, 2, 3]

相关命令整改

kafka-topic.sh

1. 修改命令启动配置（将最后一行注释掉，添加一行新的）
# 复制匹配并注释该行
sed -ri '/^exec/h;/^exec/G;s/^(exec)/# \1/' /app/kafka/bin/kafka-topics.sh 
# 修改没有注释行
sed -ri 's@^(exec.*) (kafka\.)@\1 -Djava.security.auth.login.config=$(dirname $0)/../config/kafka_jaas.conf \2@' /app/kafka/bin/kafka-topics.sh 

2. 添加连接kafka sasl配置
cat <<'EOF' | tee /app/kafka/config/sasl.properties > /dev/null
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
EOF

3. 验证命令是否可用
./kafka-topics.sh --bootstrap-server 192.168.32.189:9092 --command-config ../config/sasl.properties --list

kafka-console-consumer.sh

1. 修改命令启动配置（将最后一行注释掉，添加一行新的）
# 复制匹配并注释该行
sed -ri '/^exec/h;/^exec/G;s/^(exec)/# \1/' /app/kafka/bin/kafka-console-consumer.sh
# 修改没有注释行
sed -ri 's@^(exec.*) (kafka\.)@\1 -Djava.security.auth.login.config=$(dirname $0)/../config/kafka_jaas.conf \2@' /app/kafka/bin/kafka-console-consumer.sh

2. 创建连接kafka sasl配置
cat <<'EOF' | tee -a /app/kafka/config/consumer.properties > /dev/null

### SASL configuration begin ###
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
### SASL configuration end ###
EOF

3. 验证命令是否可用
./kafka-console-consumer.sh --bootstrap-server 192.168.32.189:9092 --consumer.config ../config/consumer.properties --topic test

kafka-console-producer.sh

1. 修改命令启动配置（将最后一行注释掉，添加一行新的）
# 复制匹配并注释该行
sed -ri '/^exec/h;/^exec/G;s/^(exec)/# \1/' /app/kafka/bin/kafka-console-producer.sh
# 修改没有注释行
sed -ri 's@^(exec.*) (kafka\.)@\1 -Djava.security.auth.login.config=$(dirname $0)/../config/kafka_jaas.conf \2@' /app/kafka/bin/kafka-console-producer.sh

2. 添加连接kafka sasl配置
cat <<'EOF' | tee -a /app/kafka/config/producer.properties > /dev/null

### SASL configuration begin ###
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
### SASL configuration end ###
EOF

3. 验证命令是否可用
./kafka-console-producer.sh --broker-list 192.168.32.189:9092 --producer.config ../config/producer.properties --topic test

kafka-consumer-groups.sh

1. 修改命令启动配置（将最后一行注释掉，添加一行新的）
# 复制匹配并注释该行
sed -ri '/^exec/h;/^exec/G;s/^(exec)/# \1/' /app/kafka/bin/kafka-consumer-groups.sh 
# 修改没有注释行
sed -ri 's@^(exec.*) (kafka\.)@\1 -Djava.security.auth.login.config=$(dirname $0)/../config/kafka_jaas.conf \2@' /app/kafka/bin/kafka-consumer-groups.sh 

2. 添加连接kafka sasl配置
cat <<'EOF' | tee /app/kafka/config/sasl.properties > /dev/null
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
EOF

3. 验证命令是否可用
./kafka-consumer-groups.sh --bootstrap-server 192.168.32.189:9092 --command-config ../config/sasl.properties --all-groups --list

kafka-preferred-replica-election.sh

1. 修改命令启动配置（将最后一行注释掉，添加一行新的）
# 复制匹配并注释该行
sed -ri '/^exec/h;/^exec/G;s/^(exec)/# \1/' /app/kafka/bin/kafka-preferred-replica-election.sh
# 修改没有注释行
sed -ri 's@^(exec.*) (kafka\.)@\1 -Djava.security.auth.login.config=$(dirname $0)/../config/kafka_jaas.conf \2@' /app/kafka/bin/kafka-preferred-replica-election.sh

2. 添加连接kafka sasl配置
cat <<'EOF' | tee /app/kafka/config/sasl.properties > /dev/null
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
EOF

3. 编写 /tmp/prefered.json 待选举的partition文件
cat <<EOF |  tee /tmp/prefered.json  >>/dev/null
{
  "partitions": [
    { "topic": "test01", "partition": 0},
    { "topic": "test01", "partition": 2}
  ]
}
EOF

4. 验证命令是否可用
./kafka-preferred-replica-election.sh --admin.config ../config/sasl.properties --bootstrap-server 192.168.32.189:9092 --path-to-json-file /tmp/prefered.json 

动态增删用户管理

创建用户

# 获取zk连接信息
zk_conn=$(awk -F= '/^zookeeper.connect=/ {print $2}' /app/kafka/config/server.properties)

# jiaxzeng 用户
cd /app/kafka/bin
./kafka-configs.sh --zookeeper ${zk_conn} --alter --add-config 'SCRAM-SHA-512=[iterations=8192,password=jiaxzeng-secret]' --entity-type users --entity-name jiaxzeng

iterations：迭代数，默认是4096

查看用户命令： ./kafka-configs.sh --zookeeper ${zk_conn} --describe --entity-type users
删除用户命令：./kafka-configs.sh --zookeeper ${zk_conn} --alter --delete-config 'SCRAM-SHA-512' --entity-type users --entity-name [USERNAME]

用户授权

# 设置用户 jiaxzeng 对主题 test 有读权限
./kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=${zk_conn} --add --allow-principal User:jiaxzeng --operation Read --topic test

# 设置用户 jiaxzeng 对 消费组 test-consumer-group 有读权限
./kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=${zk_conn} --add --allow-principal User:jiaxzeng --operation Read --group test-consumer-group

# 设置用户 jiaxzeng 仅在IP地址为 192.168.32.189 才有对主题 test 有写权限
./kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=${zk_conn} --add --allow-principal User:jiaxzeng --operation Write --topic test --allow-host 192.168.32.189

查看授权情况: ./kafka-acls.sh --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=${zk_conn} --list