How to connect to Kafka cluster with Kerberos Authentication on Windows using the Cofluent library?

Question

I'm working on a project which requires me to connect to an existing Kafka cluster using dotnet and the Confluent library. The Kafka cluster uses Kerberous/Keytab authentication. Looking at some of the documentation it looks like you can pass through the keytab file using the JAAS configuration, but when I look at the properties for the ProudcerConfig in Confluent I don't see anything about authentication. So how do I specify the keytab file so that I can authenticate against the Kafka cluster?

Answer 1

I think this section of Confluent docs mentions how to configure clients:

In your client.properties file you'd need the following configuration:

sasl.mechanism=GSSAPI
# Configure SASL_SSL if SSL encryption is enabled, otherwise configure SASL_PLAINTEXT
security.protocol=SASL_SSL

sasl.kerberos.service.name=kafka

sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \
    useKeyTab=true \
    storeKey=true \
    keyTab="/etc/security/keytabs/kafka_client.keytab" \
    principal="[email protected]";

# optionally - kafka-console-consumer or kafka-console-producer, kinit can be used along with useTicketCache=true
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required \
   useTicketCache=true;

In order to pass client.properties to e.g. kafka-console-consumer you need to provide --consumer.config parameter as well:

For Linux:

bin/kafka-console-consumer.sh --bootstrap-server localhost:9092 --topic test  --consumer.config client.properties --from-beginning

For Windows:

bin/kafka-console-consumer.bat --bootstrap-server localhost:9092 --topic test --consumer.config client.properties --from-beginning