Kerberos/GSSAPI support?

[TheF1Dev]

Hi,

Does Kafka-ui support SASL_PLAINTEXT with GSSAPI. I have tried the following settings, but i'm not sure if i'm missing something.

  - KAFKA_CLUSTERS_0_NAME=dev
  - KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=locahost:9092
  - KAFKA_CLUSTERS_0_ZOOKEEPER=locahost:2181
  - KAFKA_CLUSTERS_0_READONLY=true
  - KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL=SASL_PLAINTEXT
  - KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM=GSSAPI
  - KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true keyTab="/tmp/user.keytab" principal="user@realm" serviceName="kafka";
  - KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION=/tmp/truststore.jks
  - KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD=changeit

Am i missing something or is it not possible yet.

[germanosin]

Hi, @AlexanderRasmussen. Thanks for creating the issue.
According to the confluent description: https://docs.confluent.io/platform/current/kafka/authentication_sasl/authentication_sasl_gssapi.html

you should pass service as a separate parameter, could you please try this config:

- KAFKA_CLUSTERS_0_NAME=dev
- KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=locahost:9092
- KAFKA_CLUSTERS_0_ZOOKEEPER=locahost:2181
- KAFKA_CLUSTERS_0_READONLY=true
- KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL=SASL_PLAINTEXT
- KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM=GSSAPI
- KAFKA_CLUSTERS_0_PROPERTIES_SASL_KERBEROS_SERVICE_NAME=kafka
- KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true keyTab="/tmp/user.keytab" principal="user@realm" serviceName="kafka";
- KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION=/tmp/truststore.jks
- KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD=changeit

If this will not help you, could you please provide for better understanding?

[Ge0f3]

Whenever I add KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG=org.apache.kafka.common.security.scram.ScramLoginModule required username=username password=password

I get requried:latest image not Unable to find image 'required:latest' locally

btw my docker file

docker run --rm -p 8080:8080
-e KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL=SASL_SSL
-e KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=asd:9092
-e KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION=asdf.jks
-e KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD=asd
-e KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG=org.apache.kafka.common.security.scram.ScramLoginModule required username=usernam password=password
provectuslabs/kafka-ui:latest

[Haarolean]

@Ge0f3 try escaping values or even better try a docker-compose file (we have plenty of example ones, see the one for jaas