Mass Ingestion

Back Next

Configuring the krb5.conf file to read data from or write to a Kerberised Kafka cluster

To read from or write to a Kerberised Kafka cluster, configure the default realm, KDC, and Kafka advanced source or target properties.

You can configure Kerberos authentication for a Kafka client by placing the required Kerberos configuration files on the Secure Agent machine and specifying the required JAAS configuration in the Kafka connection. The JAAS configuration defines the keytab and principal details that the Kafka broker must use to authenticate the Kafka client.

This topic is not applicable to Mass Ingestion Applications and Mass Ingestion Databases. Mass Ingestion Applications and Mass Ingestion Databases does not yet support this functionality.

Before you read from or write to a Kerberised Kafka cluster, perform the following tasks:

Ensure that you have the

krb5.conf

file for the Kerberised Kafka cluster.

Configure the default realm and KDC. If the default

/etc/krb5.conf

file is not configured or you want to change the configuration, add the following lines to the

/etc/krb5.conf

file:

[libdefaults]
default_realm = <REALM NAME>
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true

[realms]
<REALM NAME> = {
kdc = <Location where KDC is installed> 
admin_server = <Location where KDC is installed>
                                }
 [domain_realm]
.<domain name or hostname> = <KERBEROS DOMAIN NAME>
<domain name or hostname> = <KERBEROS DOMAIN NAME>

To pass a static JAAS configuration file into the JVM using the

java.security.auth.login.config

property at runtime, perform the following tasks:

Ensure that you have JAAS configuration file.

For information about creating JAAS configuration and configuring keytab for Kafka clients, see the Apache Kafka documentation at https://kafka.apache.org/0101/documentation/#security

For example, the JAAS configuration file can contain the following lines of configuration:

//Kafka Client Authentication. Used for client to kafka broker connection
KafkaClient {
com.sun.security.auth.module.Krb5LoginModule required
doNotPrompt=true
useKeyTab=true
storeKey=true
keyTab="<path to Kafka keytab  file>/<Kafka keytab file name>"
principal="<principal name>"
client=true
};

Place the JAAS config file and keytab file in the same location on all the secure agents.

Informatica recommends that you place the files in a location that is accessible by all the secure agents in the runtime environment. For example,

/etc

/temp

Configure the following properties:

Kafka connection: Configure the
Additional Connection Properties
in a Kafka connection and specify the value in the following format:; security.protocol=SASL_PLAINTEXT,sasl.kerberos.service.name=kafka,sasl.mechanism=GSSAPI
Sources: Configure the
Consumer Configuration Properties
in the advanced source properties to override the value specified in
Additional Connection Properties
in a Kafka connection. Specify the value in the following format:; security.protocol=SASL_PLAINTEXT,sasl.kerberos.service.name=kafka,sasl.mechanism=GSSAPI
Targets: Configure the
Producer Configuration Properties
in the advanced target properties to override the value specified in
Additional Connection Properties
in a Kafka connection. Specify the value in the following format:; security.protocol=SASL_PLAINTEXT,sasl.kerberos.service.name=kafka,sasl.mechanism=GSSAPI

To embed the JAAS configuration in the

sasl.jaas.config

configuration property, configure the following properties:

Kafka connection: Configure the
Additional Connection Properties
in a Kafka connection and specify the value in the following format:; security.protocol=SASL_PLAINTEXT,sasl.kerberos.service.name=kafka,sasl.mechanism=GSSAPI, sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true doNotPrompt=true serviceName="<service_name>" keyTab="<location of keytab file>" client=true principal="<principal_name>";
Sources: Configure the
Consumer Configuration Properties
in the advanced source properties to override the value specified in
Kerberos Configuration Properties
in a Kafka connection. Specify the value in the following format:; security.protocol=SASL_PLAINTEXT,sasl.kerberos.service.name=kafka,sasl.mechanism=GSSAPI, sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true doNotPrompt=true serviceName="<service_name>" keyTab="<location of keytab file>" client=true principal="<principal_name>";
Targets: Configure the
Producer Configuration Properties
in the advanced target properties to override the value specified in
Kerberos Configuration Properties
in a Kafka connection. Specify the value in the following format:; security.protocol=SASL_PLAINTEXT,sasl.kerberos.service.name=kafka,sasl.mechanism=GSSAPI, sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true storeKey=true doNotPrompt=true serviceName="<service_name>" keyTab="<location of keytab file>" client=true principal="<principal_name>";

Rename Saved Search

Table of Contents

Mass Ingestion

Mass Ingestion

Configuring the krb5.conf file to read data from or write to a Kerberised Kafka cluster

Configuring the krb5.conf file to read data from or write to a Kerberised Kafka cluster