How to configure multiple keytab files for different Kafka topics
We have a few Kafka topics to consume in Pega; however, each topic has access to a different keytab file. Essentially, the keytab is not the same for all topics.
For example, kafka_topic1 has access to kafka_keytab1, and kafka_topic2 has access to kafka_keytab2. We need to consume these two topics in the same Pega application, and the keytab files are located in the same server location.
I have attempted to set up two JAAS configurations in the JVM settings as follows, but Pega does not recognize the second JAAS configuration for the second topic.
The configuration for the first client is -djava.security.auth.login.config=xxx/jaas1.conf, and for the second client, it's -djava.security.auth.login.config=xxx/jaas2.conf.
Is there another way to accomplish this?
Accepted Solution
Updated: 18 Oct 2023 7:00 EDT
OCBC
SG
Basically, you can create two Kafka rules for this, such as kafka_abc and kafka_xyz. Thereafter, create two Kafka client properties files as below. All JAAS file configurations can be included in sasl.jaas.config. However, make sure to follow the format below.
In this example
File : Kafka_ABC.properties
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="F:/PegaConfig/Kafka_ABC.keytab" storeKey=true useTicketCache=false serviceName="kafka" principal=" Proprietary information hidden";
File : Kafka_XYZ.properties
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="F:/PegaConfig/Kafka_XYZ.keytab" storeKey=true useTicketCache=false serviceName="kafka" principal=" Proprietary information hidden";
Here's an example for Kafka_ABC :
bootstrap.servers=localhost:9092 sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="F:/PegaConfig/Kafka_ABC.keytab" storeKey=true useTicketCache=false serviceName="kafka" principal=" Proprietary information hidden";
Upload the Kafka client property file to the Kafka rule under the Advanced Configuration section.
-
LK
@KasunJ Just a suggestion, haven't tried it personally.
JAAS Login Configuration File (oracle.com)
Java security properties file will allow multiple configurations
2. In the Java security properties file.
An alternate approach to specifying the location of the login configuration file is to indicate its URL as the value of a login.config.url.n property in the security properties file.
Accepted Solution
Updated: 18 Oct 2023 7:00 EDT
OCBC
SG
Basically, you can create two Kafka rules for this, such as kafka_abc and kafka_xyz. Thereafter, create two Kafka client properties files as below. All JAAS file configurations can be included in sasl.jaas.config. However, make sure to follow the format below.
In this example
File : Kafka_ABC.properties
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="F:/PegaConfig/Kafka_ABC.keytab" storeKey=true useTicketCache=false serviceName="kafka" principal=" Proprietary information hidden";
File : Kafka_XYZ.properties
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="F:/PegaConfig/Kafka_XYZ.keytab" storeKey=true useTicketCache=false serviceName="kafka" principal=" Proprietary information hidden";
Here's an example for Kafka_ABC :
bootstrap.servers=localhost:9092 sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="F:/PegaConfig/Kafka_ABC.keytab" storeKey=true useTicketCache=false serviceName="kafka" principal=" Proprietary information hidden";
Upload the Kafka client property file to the Kafka rule under the Advanced Configuration section.