Support SASL/Kerberos

[jorisdevrede]

Kafka v0.9.0.0 also has SASL/Kerberos support added to the new API (https://issues.apache.org/jira/browse/KAFKA-1686), which makes it possible to expand standard kerberos based security to Kafka. Could SASL (security.protocol = "SASL_PLAINTEXT" or "SASL_SSL") be added to kafka-python?

[ah-]

+1

[dpkp]

PRs welcome! I do not have an easykerberos setup to test with. Any tips or gists to get one configured for testing would be fantastic.

[markonian-117]

This is really a critical feature to have ;)

[pearlstam]

This would really make my life a lot easier :)

[jorisdevrede]

https://gist.github.com/jorisdevrede/a7933a99251452bb1867

Hi dpkp, I have put together a gist that describes how you can configure Kafka 0.9.0.0 and its accompanying Zookeeper with Kerberos. This is only a test configuration without any proper service accounts or permissions, but it should be enough for developing SASL support into kafka-python.

Please let me know if you have any questions.

[jorisdevrede]

And here is a SASL implementation that relies on PyKerberos, which you can use as a reference.

[ah-]

Has anyone looked into this? How much is required to get it running?

[dpkp]

I have not investigated deeply, but I expect it would not be terribly difficult for someone that understands the kerberos components and setup. I do not have access to a kerberos-authenticated kafka cluster and have not spent time trying to figure out how to build one myself. Until that happens I doubt I'll spend time on this feature. PRs absolutely welcome.

[gwittel]

I'd also note that there are multiple SASL backends; of which Kerberos and plain auth are builtin. However, its pluggable in Kafka (just not well documented) so in theory one can add their own auth provider (like OAuth) as well.

[DataEngg]

@dpkp , Is it possible to setup Plain authentication to brokers via SASL mechanism?

[dpkp]

Anything is possible with a PR! (kafka-python currently does not have any SASL handling code)

[larsjsol]

@DataEngg: I've made PR #779 that adds plain sasl authentication

[dpkp]

#779 merged to master. It provides SASL PLAIN auth mechanism.