kafka 配置权限

参考：https://www.cnblogs.com/huxi2b/p/10437844.html

http://kafka.apache.org/documentation/#security_authz_examples

kafka 版本 ：2.3.0
建立用户：
kafka-configs.bat --zookeeper localhost:2181/kafka-scram --alter --add-config SCRAM-SHA-256=[iterations=8192,password=writer-pwd],SCRAM-SHA-512=[password=writer-pwd] --entity-type users --entity-name writer

kafka-configs.bat --zookeeper localhost:2181/kafka-scram --alter --add-config SCRAM-SHA-256=[password=reader-pwd],SCRAM-SHA-512=[password=reader-pwd] --entity-type users --entity-name reader

kafka-configs.bat --zookeeper localhost:2181/kafka-scram --alter --add-config SCRAM-SHA-256=[password=admin],SCRAM-SHA-512=[password=admin] --entity-type users --entity-name admin

检查用户：
kafka-configs.bat --zookeeper localhost:2181/kafka-scram --describe --entity-type users --entity-name writer

配置 broker：
# 启用ACL
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
# 设置本例中admin为超级用户
super.users=User:admin
# 启用SCRAM机制，采用SCRAM-SHA-512算法
sasl.enabled.mechanisms=SCRAM-SHA-512
# 为broker间通讯开启SCRAM机制，采用SCRAM-SHA-512算法
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-512
# broker间通讯使用PLAINTEXT，本例中不演示SSL配置
security.inter.broker.protocol=SASL_PLAINTEXT
# 配置listeners使用SASL_PLAINTEXT
listeners=SASL_PLAINTEXT://172.21.0.9:9092
# 配置advertised.listeners
advertised.listeners=SASL_PLAINTEXT://172.21.0.9:9092

创建 topic：
kafka-topics.bat --create --zookeeper localhost:2181/kafka-scram --topic test --partitions 1 --replication-factor 1

为用户赋写权限：
kafka-acls.bat --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181/kafka-scram --add --allow-principal User:writer --operation Write --topic test

producer.conf 文件内容：

security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="writer" password="writer-pwd";

发送消息：
kafka-console-producer.bat --broker-list localhost:9092 --topic test --producer.config producer.conf

为用户赋读权限：
kafka-acls.bat --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181/kafka-scram --add --allow-principal User:reader --operation Read --topic test

kafka-acls.bat --authorizer kafka.security.auth.SimpleAclAuthorizer --authorizer-properties zookeeper.connect=localhost:2181/kafka-scram --add --allow-principal User:reader --operation Read --group test-group

consumer.conf 文件内容：

security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="reader" password="reader-pwd";

消费消息：
kafka-console-consumer.bat --bootstrap-server localhost:9092 --topic test --from-beginning --consumer.config consumer.conf --group test-group

不指定用户信息，连不上 kafka：
kafka-console-consumer.bat --bootstrap-server localhost:9092 --topic test --from-beginning --group zhang-group

新建用户，不赋任何权限：
kafka-configs.bat --zookeeper localhost:2181/kafka-scram --alter --add-config SCRAM-SHA-256=[iterations=8192,password=zhang-pwd],SCRAM-SHA-512=[password=zhang-pwd] --entity-type users --entity-name zhang

设置 server.properties 文件， allow.everyone.if.no.acl.found=true，重启 broker

不配置 acl 权限，也可从拉取消息：
kafka-console-consumer.bat --bootstrap-server localhost:9092 --topic test --from-beginning --consumer.config zhang.conf