You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@storm.apache.org by liu-zhaokun <gi...@git.apache.org> on 2017/04/12 09:32:33 UTC
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
GitHub user liu-zhaokun opened a pull request:
https://github.com/apache/storm/pull/2062
[STORM-2470] kafkaspout should support kerberos
[https://issues.apache.org/jira/browse/STORM-2470](url)
kafkaspout should work normally when the cluster(storm and kafka) is in kerberos mode.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/liu-zhaokun/storm master_kafkaspout_kerberos
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/storm/pull/2062.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #2062
----
commit 29737c2a9a95ad442d8d26cee590e6daee4cb0f1
Author: liuzhaokun <li...@zte.com.cn>
Date: 2017-04-12T09:30:59Z
[STORM-2470] kafkaspout should support kerberos
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm issue #2062: [STORM-2470] kafkaspout should support kerberos
Posted by liu-zhaokun <gi...@git.apache.org>.
Github user liu-zhaokun commented on the issue:
https://github.com/apache/storm/pull/2062
Hello, @harshach
Yes,you are right.But I found there isn't 'sasl.jaas.config' in kafka 0.9.x, so I will create a new PR for storm 1.0.x-branch.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
Posted by srdo <gi...@git.apache.org>.
Github user srdo commented on a diff in the pull request:
https://github.com/apache/storm/pull/2062#discussion_r111153380
--- Diff: external/storm-kafka-client/src/main/java/org/apache/storm/kafka/spout/KafkaSpoutSecurity.java ---
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.storm.kafka.spout;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.security.auth.login.Configuration;
+
+public class KafkaSpoutSecurity {
+
+ private static final Logger LOG = LoggerFactory.getLogger(KafkaSpoutSecurity.class);
+ private static final String KERBEROS_AUTH_JASSCONF = "java.security.auth.login.config";
+
+ public synchronized static void PrepareKerberos(String pathToJaas) {
+ if(pathToJaas == null || pathToJaas.isEmpty()){
+ LOG.info("No jaas.conf found.");
--- End diff --
Nitpick: Maybe add to the log that this disables Kerberos.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm issue #2062: [STORM-2470] kafkaspout should support kerberos
Posted by harshach <gi...@git.apache.org>.
Github user harshach commented on the issue:
https://github.com/apache/storm/pull/2062
@liu-zhaokun KafkaSpoutConfig offers this method to add security-related configs
https://github.com/apache/storm/blob/master/external/storm-kafka-client/src/main/java/org/apache/storm/kafka/spout/KafkaSpoutConfig.java#L227
you can pass in consumer side properties by passing in "sasl.jaas.config" via setProps/setProp method.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
Posted by srdo <gi...@git.apache.org>.
Github user srdo commented on a diff in the pull request:
https://github.com/apache/storm/pull/2062#discussion_r111152735
--- Diff: conf/defaults.yaml ---
@@ -314,4 +314,7 @@ worker.metrics:
"CGroupCpu": "org.apache.storm.metric.cgroup.CGroupCpu"
"CGroupCpuGuarantee": "org.apache.storm.metric.cgroup.CGroupCpuGuarantee"
-num.stat.buckets: 20
\ No newline at end of file
+num.stat.buckets: 20
+
+# Config for storm-kafka-client
+kafkaspout.jaasconf.path: null
--- End diff --
Could this be passed in KafkaSpoutConfig instead?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
Posted by srdo <gi...@git.apache.org>.
Github user srdo commented on a diff in the pull request:
https://github.com/apache/storm/pull/2062#discussion_r111153241
--- Diff: storm-client/src/jvm/org/apache/storm/Config.java ---
@@ -1481,6 +1481,12 @@
@isPositiveNumber
public static final String NUM_STAT_BUCKETS = "num.stat.buckets";
+ /**
+ * The path to KafkaClient's jaas.conf when use storm-kakfa-client in Security mode.
+ */
+ @isString
+ public static final String KAFKASPOUT_JAASCONF_PATH = "kafkaspout.jaasconf.path";
--- End diff --
Similar to the above, if possible I think this would fit better in KafkaSpoutConfig.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
Posted by liu-zhaokun <gi...@git.apache.org>.
Github user liu-zhaokun closed the pull request at:
https://github.com/apache/storm/pull/2062
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
Posted by srdo <gi...@git.apache.org>.
Github user srdo commented on a diff in the pull request:
https://github.com/apache/storm/pull/2062#discussion_r111153122
--- Diff: external/storm-kafka-client/src/main/java/org/apache/storm/kafka/spout/KafkaSpoutSecurity.java ---
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.storm.kafka.spout;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.security.auth.login.Configuration;
+
+public class KafkaSpoutSecurity {
+
+ private static final Logger LOG = LoggerFactory.getLogger(KafkaSpoutSecurity.class);
+ private static final String KERBEROS_AUTH_JASSCONF = "java.security.auth.login.config";
+
+ public synchronized static void PrepareKerberos(String pathToJaas) {
+ if(pathToJaas == null || pathToJaas.isEmpty()){
+ LOG.info("No jaas.conf found.");
+ }else{
+ Configuration login_conf = Configuration.getConfiguration();
+ System.setProperty(KERBEROS_AUTH_JASSCONF, pathToJaas);
+ login_conf.refresh();
--- End diff --
I'm not familiar with jaas. Is it necessary to get the configuration, set the system property and then reload, rather than setting the system property and then getting the configuration?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm issue #2062: [STORM-2470] kafkaspout should support kerberos
Posted by harshach <gi...@git.apache.org>.
Github user harshach commented on the issue:
https://github.com/apache/storm/pull/2062
@liu-zhaokun More details are documented here http://kafka.apache.org/documentation.html#security_sasl . We don't need these changes on storm-kafka-client side
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm issue #2062: [STORM-2470] kafkaspout should support kerberos
Posted by harshach <gi...@git.apache.org>.
Github user harshach commented on the issue:
https://github.com/apache/storm/pull/2062
@liu-zhaokun with the latest kafka consumer APIs one can pass a keytab and principal via consumer or producer properties. Even before that they can pass the jaas config via JVM param and set security.protocol to SASL_PLAINTEXT.
with the new kafka client APIs we are trying hard to remain with configs supported by them. Let's not introduce to new configs on storm side to make it confusing for the user.
I am -1 on this.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
Posted by srdo <gi...@git.apache.org>.
Github user srdo commented on a diff in the pull request:
https://github.com/apache/storm/pull/2062#discussion_r111152884
--- Diff: external/storm-kafka-client/src/main/java/org/apache/storm/kafka/spout/KafkaSpoutSecurity.java ---
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.storm.kafka.spout;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.security.auth.login.Configuration;
+
+public class KafkaSpoutSecurity {
+
+ private static final Logger LOG = LoggerFactory.getLogger(KafkaSpoutSecurity.class);
+ private static final String KERBEROS_AUTH_JASSCONF = "java.security.auth.login.config";
--- End diff --
Nitpick: Shouldn't this be JAASCONF and not JASSCONF?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm issue #2062: [STORM-2470] kafkaspout should support kerberos
Posted by liu-zhaokun <gi...@git.apache.org>.
Github user liu-zhaokun commented on the issue:
https://github.com/apache/storm/pull/2062
Users should provide the path to jaas.conf which includes a section named "KafkaClient" in storm.yaml or .
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] storm pull request #2062: [STORM-2470] kafkaspout should support kerberos
Posted by srdo <gi...@git.apache.org>.
Github user srdo commented on a diff in the pull request:
https://github.com/apache/storm/pull/2062#discussion_r111153449
--- Diff: external/storm-kafka-client/src/main/java/org/apache/storm/kafka/spout/KafkaSpoutSecurity.java ---
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.storm.kafka.spout;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import javax.security.auth.login.Configuration;
+
+public class KafkaSpoutSecurity {
+
+ private static final Logger LOG = LoggerFactory.getLogger(KafkaSpoutSecurity.class);
+ private static final String KERBEROS_AUTH_JASSCONF = "java.security.auth.login.config";
+
+ public synchronized static void PrepareKerberos(String pathToJaas) {
+ if(pathToJaas == null || pathToJaas.isEmpty()){
+ LOG.info("No jaas.conf found.");
+ }else{
+ Configuration login_conf = Configuration.getConfiguration();
+ System.setProperty(KERBEROS_AUTH_JASSCONF, pathToJaas);
+ login_conf.refresh();
+ LOG.info("Use storm-kakfa-client in Security mode.");
+ }
--- End diff --
Nitpick: Weird indentation
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---