forked from navikt/kafka-plain-saslserver-2-ad
-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Joe Schmetzer
committed
Aug 18, 2020
1 parent
b2f489e
commit 63864fa
Showing
4 changed files
with
30 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,8 +1,4 @@ | ||
# kafka-plain-saslserver-2-ad | ||
|
||
[![Build Status](https://travis-ci.org/navikt/kafka-plain-saslserver-2-ad.svg?branch=master)](https://travis-ci.org/navikt/kafka-plain-saslserver-2-ad/builds/) | ||
[![Docker Build Status](https://img.shields.io/docker/build/navikt/kafka-plain-saslserver-2-ad.svg)](https://hub.docker.com/r/navikt/kafka-plain-saslserver-2-ad/builds/) | ||
[![Docker Automated build](https://img.shields.io/docker/automated/navikt/kafka-plain-saslserver-2-ad.svg)](https://hub.docker.com/r/navikt/kafka-plain-saslserver-2-ad/) | ||
# kafka-ldap-integration | ||
|
||
Enhancing kafka 2.x with | ||
- customized SimpleLDAPAuthentication using LDAPS simple bind for authentication | ||
|
@@ -25,19 +21,19 @@ giving minor performance penalty and reduced LDAPS traffic. | |
|
||
1. Unboundid LDAP SDK for LDAPS interaction | ||
2. Caffeine Cache | ||
3. YAML Configuration for LDAP baseDN for users, groups and more. See src/test/resources/ldapconfig.yaml for details | ||
3. YAML Configuration for LDAP baseDN for users, groups and more. See `src/test/resources/ldapconfig.yaml` for details | ||
|
||
**Observe** that the directory hosting yaml configuration file must be in CLASSPATH. | ||
**N.B.** that the directory hosting yaml configuration file must be in CLASSPATH. | ||
|
||
## Kafka configuration examples | ||
|
||
JAAS context file on Kafka broker use the standard class for plain login module during authentication | ||
|
||
``` | ||
KafkaServer{ | ||
org.apache.kafka.common.security.plain.PlainLoginModule required | ||
username="x" | ||
password="y"; | ||
org.apache.kafka.common.security.plain.PlainLoginModule required | ||
username="x" | ||
password="y"; | ||
}; | ||
``` | ||
|
||
|
@@ -50,43 +46,38 @@ listeners=SASL_PLAINTEXT://localhost:9092 | |
security.inter.broker.protocol=SASL_PLAINTEXT | ||
sasl.mechanism.inter.broker.protocol=PLAIN | ||
sasl.enabled.mechanisms=PLAIN | ||
listener.name.sasl_plaintext.plain.sasl.server.callback.handler.class=no.nav.common.security.authentication.SimpleLDAPAuthentication | ||
authorizer.class.name=no.nav.common.security.authorization.SimpleLDAPAuthorizer | ||
... | ||
listener.name.sasl_plaintext.plain.sasl.server.callback.handler.class=com.instaclustr.kafka.ldap.authentication.SimpleLDAPAuthentication | ||
authorizer.class.name=com.instaclustr.kafka.ldap.authorization.SimpleLDAPAuthorizer | ||
... | ||
``` | ||
|
||
## Using the docker image | ||
The docker image can't currently be used standalone, the Dockerfile is supposed to be extended by adding the config file | ||
`/etc/kafka/ldapconfig.yaml` and the jaas configuration `/etc/kafka/kafka_server_jaas.conf`, examples of these | ||
config files can be found in [NAVs kafka docker compose project](https://github.com/navikt/navkafka-docker-compose) | ||
|
||
## Testing | ||
|
||
Use of Unboundid in-memory LDAP server for all test cases. | ||
|
||
Tested on confluent.io version 5.x (related to apache kafka 2.x) | ||
|
||
See [Confluent Open Source distribution](https://www.confluent.io/product/confluent-open-source/) in order to test locally. | ||
Tested on Kafka version 2.x | ||
|
||
The related [Wiki](https://github.com/navikt/KafkaPlainSaslServer2AD/wiki) has a detailed guide for local testing. | ||
See [Apache Kafka](https://kafka.apache.org/) in order to test locally. | ||
|
||
## Build | ||
|
||
``` | ||
./gradlew clean build | ||
./gradlew shadowJar | ||
The result is kafka-plain-salserver-2-ad-2.0_<version>.jar hosting authentication and authorization classes. | ||
``` | ||
**Observe** that the directory hosting the given JAR file must be in CLASSPATH. | ||
|
||
The result is `kafka-ldap-integration-2.4_<version>.jar` hosting authentication and authorization classes. | ||
|
||
**N.B.** that the directory hosting the given JAR file must be in CLASSPATH. | ||
|
||
### Contact us | ||
#### Code/project related questions can be sent to | ||
* Joe Schmetzer, `[email protected] ` | ||
* Zeke Dean, `[email protected]` | ||
|
||
#### Credit to original authors | ||
|
||
Maintainers of the GitHub project [kafka-plain-saslserver-2-ad](https://github.com/navikt/kafka-plain-saslserver-2-ad): | ||
* Torstein Nesby, `[email protected]` | ||
* Trong Huu Nguyen, `[email protected]` | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8 changes: 4 additions & 4 deletions
8
src/test/kotlin/com/instaclustr/kafka/ldap/authorization/GroupAuthorizerSpec.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters