Configure SSL and ACLs for kafka-console-consumer

3
votes

I am adding SSL security to my Confluent-3.0.1 Kafka Cluster following the instructions here and here.

In the Linux transaction snippets below, I have replaced my server names with myserverA, myserverB and myserverC. I also obscured passwords. This is my first posting on a message board. I apologize for any poorly formatted sections of this post.

My questions:

What ACL controls the access to fetch offsets shown just below? Do I need to change my configuration or SSL keys?

Many thanks for any assistance you may be able to provide.

I was able to produce data using the kafka-console-producer over SSL, but can not read the data using the kafka-console-consumer. I receive the following error:

[kafka@myserverA confluent-3.0.1]$ /kafka/confluent-3.0.1/bin/kafka-console-consumer --bootstrap-server myserverA:9093 --zookeeper myserverA:2181/kafka --topic ssl-test --from-beginning --new-consumer --consumer.config /kafka/data/client/ssl/client.properties
[2017-06-27 13:11:50,462] WARN Attempt to fetch offsets for partition ssl-test-0 failed due to: Not authorized to access topics: [Topic authorization failed.] (org.apache.kafka.clients.consumer.internals.Fetcher)
[2017-06-27 13:11:50,473] WARN Error while fetching metadata with correlation id 6 : {ssl-test=TOPIC_AUTHORIZATION_FAILED} (org.apache.kafka.clients.NetworkClient)
[2017-06-27 13:11:50,476] ERROR Unknown error when running consumer:  (kafka.tools.ConsoleConsumer$)
org.apache.kafka.common.errors.TopicAuthorizationException: Not authorized to access topics: [ssl-test]

It is not clear if my problem is in the client configuration, or the inter-broker configuration.

The server.properties file on each of my three brokers includes the following:

###################### SSL Configuration ################
#
ssl.keystore.location=/kafka/data/ssl/keystore/kafka.keystore.jks
ssl.keystore.password=<hidden for this posting>
ssl.key.password=<hidden for this posting>
ssl.truststore.location=/kafka/data/ssl/truststore/kafka.truststore.jks
ssl.truststore.password=<hidden for this posting>

ssl.client.auth=requested
#ssl.cipher.suites=
ssl.enabled.protocols = TLSv1.2,TLSv1.1,TLSv1
ssl.keystore.type = JKS
ssl.truststore.type = JKS

security.inter.broker.protocol=ssl

# #### Enable ACLs ####
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
allow.everyone.if.no.acl.found=true

super.users=User:CN=myserverA,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US;User:myserverB,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US;User:CN=myserverC,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US

I use the same client.properties for the producer.config and consumer.config. It contains the following:

###################### SSL Configuration ################
#
security.protocol=ssl

ssl.keystore.location=/kafka/data/client/ssl/keystore/kafka.client.keystore.jks
ssl.keystore.password=<hidden for this posting>
ssl.key.password=<hidden for this posting>
ssl.truststore.location=/kafka/data/client/ssl/truststore/kafka.client.truststore.jks
ssl.truststore.password=<hidden for this posting>

#ssl.provider=
#ssl.cipher.suites=
ssl.enabled.protocols = TLSv1.2,TLSv1.1,TLSv1
ssl.keystore.type = JKS
ssl.truststore.type = JKS

I have a large number of ACL grants on the ssl-test topic. I have tried: 1)SSL Dnames with spaces after commas, 2) SSL Dnames with no spaces after commas, 3) SSL Common Names for broker certs

[root@myserverA ~]# /kafka/confluent-3.0.1/bin/kafka-acls --authorizer-properties zookeeper.connect=myserverA:2181/kafka --list --topic ssl-test
Current ACLs for resource `Topic:ssl-test`:
User:CN=Test Client,OU=Test Client Unit,O=Test Client Org,L=LA,ST=CA,C=US has Allow permission for operations: Read from hosts: *
User:CN=Test Client, OU=Test Client Unit, O=Test Client Org, L=LA, ST=CA, C=US has Allow permission for operations: Read from hosts: *
User:myserverA has Allow permission for operations: Write from hosts: *
User:myserverC has Allow permission for operations: Read from hosts: *
User:CN=myserverB,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US has Allow permission for operations: Write from hosts: *
User:CN=myserverA,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US has Allow permission for operations: Read from hosts: *
User:Test Client has Allow permission for operations: Read from hosts: *
User:Test Client has Allow permission for operations: Write from hosts: *
User:myserverB has Allow permission for operations: Write from hosts: *
User:CN=Test Client,OU=Test Client Unit,O=Test Client Org,L=LA,ST=CA,C=US has Allow permission for operations: Write from hosts: *
User:CN=myserverC,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US has Allow permission for operations: Read from hosts: *
User:CN=myserverA,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US has Allow permission for operations: Write from hosts: *
User:CN=myserverB,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US has Allow permission for operations: Read from hosts: *
User:myserverB has Allow permission for operations: Read from hosts: *
User:myserverA has Allow permission for operations: Read from hosts: *
User:CN=Test Client, OU=Test Client Unit, O=Test Client Org, L=LA, ST=CA, C=US has Allow permission for operations: Write from hosts: *
 ser:myserverC has Allow permission for operations: Write from hosts: *
 ser:CN=myserverC,OU=NBCUniversal,O=NBCUniversal,L=NY,ST=NY,C=US has Allow permission for operations: Write from hosts: *

The kafka-console-producer functions normally through SSL:

[kafka@myserverA confluent-3.0.1]$ bin/kafka-console-producer --broker-list myserverA:9093 --topic ssl-test --producer.config /kafka/data/client/ssl/client.properties
j
k
<Ctrl-D>
2
sslapache-kafka
Per the documentation, to consume you need READ access on the topic and the group. While you've given the ACLs for the topic in your post, you've not said if there are any ACLs for the consumer group. - Tom Bentley
Also, by default the usernames are SSL names without spaces. You can customize this though, see docs.confluent.io/current/kafka/… - Tom Bentley
Hi @tombentley, excellent suggestion. It was my understanding that the --new-consumer argument automatically created the group and granted access. However, I added group.id=ssl-test-group to my client.properties and included the client cert in a group ACL: - RSmith
This produced the same response. - RSmith

2 Answers

1
votes

According to the documentation the consumer needs both READ and DESCRIBE on the topic, as well as the consumer groups needing READ. The option --consumer can be used as a convenience to set all of these as once; using their example:

bin/kafka-acls.sh --authorizer-properties zookeeper.connect=localhost:2181 \
  --add \
  --allow-principal User:Bob \
  --consumer \
  --topic Test-topic \
  --group Group-1
0
votes

There were multiple issues in my Kafka SSL configuration. However, the explicit error "WARN Attempt to fetch offsets for partition ssl-test-0 failed..." while running kafka-console-consumer was due to the fact that the Client Certificate was not included in the truststore for kafka node B and C.