KAFKA-4589: SASL/SCRAM documentation by rajinisivaram · Pull Request #2369 · apache/kafka

rajinisivaram · 2017-01-13T17:02:53Z

No description provided.

rajinisivaram · 2017-01-13T17:03:51Z

This is currently a commit on top of the docs for sasl.jaas.config. I will rebase after that is committed.

asfbot · 2017-01-13T17:48:31Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.11/843/
Test PASSed (JDK 8 and Scala 2.11).

asfbot · 2017-01-13T17:48:33Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.12/841/
Test PASSed (JDK 8 and Scala 2.12).

gwenshap

LGTM. One minor phrasing change.

gwenshap · 2017-01-13T18:41:04Z

The phrasing is a bit awkward - "We support SASL (Kerberos), and then we added SASL/PLAIN and then we added SASL/SCRAM". Almost makes it seem like the additional protocols are an afterthought and may deter usage.

Perhaps just something like this will be clearer:

We support the following mechanisms:

SASL/KERBEROS - starting at version 0.9.0.0

SASL/PLAIN - starting at version 0.10.0.0

SASL/SCRAM-SHA-256 and SASL/SCRAM-SHA-512 - starting at version 0.10.2.0

@gwenshap Thank you for the review and the suggestion. I have updated the doc.

asfbot · 2017-01-13T19:20:37Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.11/854/
Test FAILed (JDK 8 and Scala 2.11).

asfbot · 2017-01-13T20:02:54Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk7-scala2.10/852/
Test FAILed (JDK 7 and Scala 2.10).

asfbot · 2017-01-13T20:03:49Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk7-scala2.10/841/
Test FAILed (JDK 7 and Scala 2.10).

asfbot · 2017-01-13T20:04:27Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.12/852/
Test PASSed (JDK 8 and Scala 2.12).

harshach · 2017-01-14T04:41:45Z

+1

ijuma · 2017-01-14T14:56:38Z

One question about this: why did we do 2 separate mechanisms instead of a single mechanism with a config for the hashing algorithm used? It's a bit late to be asking this, but this hasn't been released yet, so there's still a bit of time. :)

@ijuma SCRAM mechanism names are defined in RFC-5802 (https://tools.ietf.org/html/rfc5802#section-4). So we are using the standard name rather than defining our own.

That makes sense, thanks for the explanation.

ijuma · 2017-01-14T14:57:43Z

cc @junrao since he reviewed the main PR.

rajinisivaram · 2017-01-17T15:55:25Z

@ijuma I have rebased this on top of the JAAS doc. Also, in the second commit in this PR (to make it easy to undo if required), I have tried to remove duplication. Not sure if I have made it better or worse. Can you take a look, please? Thank you!

asfbot · 2017-01-17T16:41:06Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.11/932/
Test PASSed (JDK 8 and Scala 2.11).

asfbot · 2017-01-17T16:42:05Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.12/930/
Test PASSed (JDK 8 and Scala 2.12).

asfbot · 2017-01-17T16:47:02Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk7-scala2.10/930/
Test PASSed (JDK 7 and Scala 2.10).

junrao

@rajinisivaram : Thanks for the patch. Left a couple of comments.

junrao · 2017-01-18T21:54:29Z

+                The login module describes how the clients like producer and consumer can connect to the Kafka Broker.
+	        The following is an example configuration for a client for the SCRAM mechanisms:
+                <pre>
+   asl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required \


missing an s at the beginning?

junrao · 2017-01-18T21:55:02Z

+            <li>Kafka supports only the strong hash functions SHA-256 and SHA-512 with a minimum iteration count
+            of 4096. Strong hash functions combined with strong passwords and high iteration counts protect
+            against brute force attacks if Zookeeper security is compromised.</li>
+            <li>SCRAM should be used only with TLS-encryption to prevent interception of SCRAM exchanges. This


Hmm, does SCRAM need to be used with TLS? I thought the main advantage of SCRAM over PLAIN is that you don't need to encrypt the wire transfer since it's hard to compromise the password even if the wire transfer is intercepted.

@junrao Thank you for the review. SCRAM is safe against replay attacks and the information obtained using interception is not sufficient to impersonate a client. Offline brute force attacks can be used with the intercepted data to try to recover the user's password, but this is mitigated with the use of strong hash functions, strong passwords etc.

If Zookeeper (the SCRAM credential store) security is compromised, then the intercepted data from a PLAINTEXT connection combined with the stored credential in Zookeeper can be used to impersonate the client. To protect against this, it is recommended that SCRAM is used with TLS. I think we should encourage the use of TLS in the docs so that anyone using PLAINTEXT with SCRAM looks more into the security considerations and understands the risks.

junrao · 2017-01-19T02:39:45Z

+                    a login module in <tt>KafkaClient</tt> for the selected mechanism as described in the examples
+                    for setting up <a href="#security_sasl_kerberos_clientconfig">GSSAPI (Kerberos)</a>,
+                    <a href="#security_sasl_plain_clientconfig">PLAIN</a> or
+                    <a href="#security_sasl_scram_clientconfig">SCRAM</a></li>.


Is "/li>" extra?

asfbot · 2017-01-19T10:50:04Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.12/1017/
Test PASSed (JDK 8 and Scala 2.12).

asfbot · 2017-01-19T10:51:09Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk7-scala2.10/1017/
Test PASSed (JDK 7 and Scala 2.10).

asfbot · 2017-01-19T10:54:05Z

Refer to this link for build results (access rights to CI server needed):
https://builds.apache.org/job/kafka-pr-jdk8-scala2.11/1019/
Test PASSed (JDK 8 and Scala 2.11).

junrao · 2017-01-19T16:32:48Z

Thanks for the patch. LGTM

Author: Rajini Sivaram <rajinisivaram@googlemail.com> Reviewers: Ismael Juma <ismael@juma.me.uk>, Gwen Shapira <cshapi@gmail.com>, Sriharsha Chintalapani <harsha@hortonworks.com>, Jun Rao <junrao@gmail.com> Closes #2369 from rajinisivaram/KAFKA-4589 (cherry picked from commit 666abaf) Signed-off-by: Jun Rao <junrao@gmail.com>

Author: Rajini Sivaram <rajinisivaram@googlemail.com> Reviewers: Ismael Juma <ismael@juma.me.uk>, Gwen Shapira <cshapi@gmail.com>, Sriharsha Chintalapani <harsha@hortonworks.com>, Jun Rao <junrao@gmail.com> Closes apache#2369 from rajinisivaram/KAFKA-4589

gwenshap approved these changes Jan 13, 2017

View reviewed changes

ijuma reviewed Jan 14, 2017

View reviewed changes

rajinisivaram added 2 commits January 17, 2017 13:05

KAFKA-4589: SASL/SCRAM documentation

0fdeb10

KAFKA-4589: Remove duplication in SASL doc

7d36f13

rajinisivaram force-pushed the KAFKA-4589 branch from d4c32c7 to 7d36f13 Compare January 17, 2017 15:52

junrao reviewed Jan 18, 2017

View reviewed changes

junrao reviewed Jan 19, 2017

View reviewed changes

KAFKA-4589: Fix typo

b3620cc

asfgit closed this in 666abaf Jan 19, 2017

Conversation

rajinisivaram commented Jan 13, 2017

Uh oh!

rajinisivaram commented Jan 13, 2017

Uh oh!

asfbot commented Jan 13, 2017

Uh oh!

asfbot commented Jan 13, 2017

Uh oh!

gwenshap left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

asfbot commented Jan 13, 2017

Uh oh!

asfbot commented Jan 13, 2017

Uh oh!

asfbot commented Jan 13, 2017

Uh oh!

asfbot commented Jan 13, 2017

Uh oh!

harshach commented Jan 14, 2017

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ijuma commented Jan 14, 2017

Uh oh!

rajinisivaram commented Jan 17, 2017

Uh oh!

asfbot commented Jan 17, 2017

Uh oh!

asfbot commented Jan 17, 2017

Uh oh!

asfbot commented Jan 17, 2017

Uh oh!

junrao left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

junrao Jan 19, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

asfbot commented Jan 19, 2017

Uh oh!

asfbot commented Jan 19, 2017

Uh oh!

asfbot commented Jan 19, 2017

Uh oh!

junrao commented Jan 19, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

junrao Jan 19, 2017 •

edited

Loading