YouTube video walkthrough
General Idea
Conduktor leverages the default Apache Kafka Java Clients, and therefore we use the same configuration properties. If you are trying to connect to a secure Kafka cluster using Conduktor, please first try to use the CLI. If you don’t know how, please contact your administrator. Example:config.properties
file may contain something like this:
config.properties
file.
In case you don’t know what should be the values in the config.properties file, please contact your Kafka administrator.
Note: these are the same properties you would use in your Kafka Java clients or applications.
SSL Configuration
If client authentication is not required by the broker, the following is a minimal configuration example:- ssl.provider (Optional). The name of the security provider used for SSL connections. Default value is the default security provider of the JVM.
- ssl.cipher.suites (Optional). A cipher suite is a named combination of authentication, encryption, MAC and key exchange algorithm used to negotiate the security settings for a network connection using TLS or SSL network protocol.
- ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1. It should list at least one of the protocols configured on the broker side
- ssl.truststore.type=JKS
- ssl.keystore.type=JKS
Please make sure to put the full paths to your SSL certificates in your
properties file\ Relative paths may not work for Conduktor.
SASL Configuration
Multiple SASL configurations can be done for Apache Kafka and Conduktor supports them all. In this documentation we will just cover Kerberos, but you should get a general sense of how things work. Here’s a minimal configuration for SASL_PLAINTEXT:SCRAM configuration
Use this configuration in Conduktor:🚨 About JAAS files
If you see a JAAS file being passed as a Java option to your Kafka clients usingsasl.jaas.config
property as outlined above in Conduktor.
Example: the following JAAS file:
sasl.jaas.config
property:
Please make sure to put the full paths to your SASL key files in your properties
file\ Relative paths may not work for Conduktor.
Example using Kerberos
Another example using Kerberos and a keytab:- a JAAS file (would need -Djava.security.auth.login.config=/path/to/jaas.conf)
- The same, but using
sasl.jaas.config
:
Troubleshooting : ” KrbException: Pre-authentication information was invalid ” ERROR\
- Cause 1: The password entered is incorrect.
- Solution 1: Verify the password.
- Cause 2: If you are using the keytab to get the key (e.g., by setting the
useKeyTab
option totrue
in the Krb5LoginModule entry in the JAAS login configuration file), then the key might have changed since you updated the keytab.- Solution 2: Consult your Kerberos documentation to generate a new keytab and use that keytab.
- Cause 3: Clock skew - If the time on the KDC and on the client differ significantly (typically 5 minutes), this error can be returned.
- Solution 3: Synchronize the clocks (or have a system administrator do so).
- Cause 4: The Kerberos realm name is not all uppercase.
- Solution 4: Make the Kerberos realm name all uppercase. Note: It is recommended to have all uppercase realm names. See Naming Conventions for Realm Names and Hostnames.
FAQ
Ensure you are using the Java-style configuration
If you are sure you have configured your connection properly in Conduktor and it works in other tools, make sure you’re using the official configuration Java-style, and not the C-style (librdkafka). It may happen when you work with Python or nodejs (both are using librdkafka behind the scene). Here are all the properties of librdkafka, some of them are different from the official Java configuration (that Conduktor supports). For instance, the following (common) properties are NOT compatible with Conduktor:How to avoid SSL handshake errors?
When you setup a kafka cluster with a self-signed CA certificate (not official) because it’s just for development, you might get an error from Conduktor:- org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
- javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.