安装带有ACL的kafka集群

1. tar -zxvf kafka_2.11-0.11.0.2.tgz -C /app/svr/

2. ln -s /app/svr/kafka_2.11-0.11.0.2/ /app/svr/kafka

3. cd /app/svr/kafka

4. vi config/server.properties

listeners=SASL_PLAINTEXT://0.0.0.0:9092
advertised.listeners=SASL_PLAINTEXT://cent1.steven:9092
log.dirs=/app/data/kafka-logs
auto.create.topics.enable=false
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.enabled.mechanisms=PLAIN
sasl.mechanism.inter.broker.protocol=PLAIN
authorizer.class.name = kafka.security.auth.SimpleAclAuthorizer
super.users=User:kafka

5. vi config/zookeeper.properties

dataDir=/app/data/zookeeper
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
maxClientCnxns=100
tickTime=2000
initLimit=10
syncLimit=5

6. vi config/kafka_server_jaas.conf

KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="kafka"
password="kafka-changeme"
user_kafka="kafka-changeme"
user_alice="alice-changeme"
user_bob="bob-changeme";
};
Client {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="kafka"
password="kafka-changeme;
};

7. vi config/kafka_zoo_jaas.conf

Server {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="kafka"
password="kafka-changeme"
user_kafka="kafka-changeme";
};

8. vi config/kafka_client_jaas.conf

KafkaClient {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="alice"
password="alice-changeme";
};

9. vi config/producer.properties

security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN

10. vi config/consumer.properties

security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN

11. vi bin/kafka-server-start.sh export KAFKA_OPTS before exec command

export KAFKA_OPTS=" -Djava.security.auth.login.config=/app/svr/kafka/config/kafka_server_jaas.conf"

12. vi bin/zookeeper-server-start.sh export KAFKA_OPTS before exec command

export KAFKA_OPTS=" -Djava.security.auth.login.config=/app/svr/kafka/config/kafka_zoo_jaas.conf"

13. vi bin/kafka-console-consumer.sh & bin/kafka-console-producer.sh export KAFKA_OPTS before exec command

export KAFKA_OPTS=" -Djava.security.auth.login.config=/app/svr/kafka/config/kafka_client_jaas.conf"

14. bin/zookeeper-server-start.sh -daemon config/zookeeper.properties

15. bin/kafka-server-start.sh -daemon config/server.properties

=======================================================

16. bin/kafka-topics.sh --create --topic test --zookeeper cent1.steven:2181 --partitions 3 --replication-factor 1
17. bin/kafka-topics.sh --list --zookeeper cent1.steven:2181
18. vi config/kafka_admin_jaas.conf

Client {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="kafka"
password="kafka-changeme";
};

19. vi bin/kafka-acls.sh export KAFKA_OPTS before exec command

export KAFKA_OPTS=" -Djava.security.auth.login.config=/app/svr/kafka/config/kafka_admin_jaas.conf"

20. bin/kafka-acls.sh --authorizer-properties zookeeper.connect=cent1.steven:2181 --add --allow-principal User:* --allow-host=* --operation All --topic test --group=*
21. bin/kafka-acls.sh --authorizer-properties zookeeper.connect=cent1.steven:2181 --list --topic test
22. bin/kafka-console-producer.sh --topic test --broker-list cent1.steven:9092 --producer.config config/producer.properties
23. bin/kafka-console-consumer.sh --new-consumer --topic test --bootstrap-server cent1.steven:9092 --consumer.config config/consumer.properties