[ https://issues.apache.org/jira/browse/KAFKA-3687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15755625#comment-15755625 ]
Raghu Baddam commented on KAFKA-3687: ------------------------------------- [~rsivaram]: I am about to send a mail to you :), you are suggestion is really helpful. {code} [2016-12-16 21:55:36,720] DEBUG Principal = User:CN=writeuser,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown is Allowed Operation = Create from host = 172.28.89.63 on resource = Cluster:kafka-cluster (kafka.authorizer.logger) {code} Finally I am getting the user as exactly what I set in my SSL-Cert (Not Anonymous). But, I am getting another Error i.e {code} [2016-12-16 13:55:36,449] WARN Error while fetching metadata with correlation id 45 : {my-ssl-topic=LEADER_NOT_AVAILABLE} (org.apache.kafka.clients.NetworkClient) [2016-12-16 13:55:36,609] WARN Error while fetching metadata with correlation id 46 : {my-ssl-topic=LEADER_NOT_AVAILABLE} (org.apache.kafka.clients.NetworkClient) [2016-12-16 13:55:36,766] WARN Error while fetching metadata with correlation id 47 : {my-ssl-topic=LEADER_NOT_AVAILABLE} (org.apache.kafka.clients.NetworkClient) {code} I created the topic and my kafka node is working without any issues (I restarted several time) [raghu@Kafka-238343-1-33109167 kafka_2.11-0.10.1.0]$ bin/kafka-topics.sh --describe --zookeeper localhost:2181 --topic my-ssl-topic {code} Topic:my-ssl-topic PartitionCount:1 ReplicationFactor:1 Configs: Topic: my-ssl-topic Partition: 0 Leader: 0 Replicas: 0 Isr: 0 {code} > Internal Authorization Failure at startup with ACLs and > security.inter.broker.protocol=PLAINTEXT > ------------------------------------------------------------------------------------------------ > > Key: KAFKA-3687 > URL: https://issues.apache.org/jira/browse/KAFKA-3687 > Project: Kafka > Issue Type: Bug > Affects Versions: 0.10.0.0 > Reporter: Edoardo Comar > > The root cause is this failure in the authorizer.log at server startup: > [] DEBUG Principal = User:ANONYMOUS is Denied Operation = ClusterAction from > host = 192.168.10.22 on resource = Cluster:kafka-cluster > (kafka.authorizer.logger) > and has the *consequence that it's impossible to authorize a producer*. > Steps to reproduce : > [~mimaison] and I launched a single broker and a console producer, > using the SASL_PLAIN authentication between producer and broker. > Created a topic "testtopic". > The broker is configured with the SimpleAclAuthorizer > and the ACL created for the producer is : > ./kafkacls.sh --authorizer-properties zookeeper.connect=localhost:2181 --add > --allow-principal User:edo1 --producer --topic testtopic > which results in : > Current ACLs for resource `Topic:testtopic`: > User:edo1 has Allow permission for operations: Write from hosts: * > User:edo1 has Allow permission for operations: Describe from hosts: * > Current ACLs for resource `Cluster:kafka-cluster`: > User:edo1 has Allow permission for operations: Create from hosts: * > However running the producer, we got: > [] WARN Error while fetching metadata with correlation id 0 : > {testtopic=UNKNOWN_TOPIC_OR_PARTITION} > (org.apache.kafka.clients.NetworkClient) > Looking at the code, the UpdateMedataRequest that the single broker sends to > itself on startup, > which come through as a request with User:ANONYMOUS get denied by the > Authoriser > (in KafkaApis.handleUpdateMetadataRequest) > and the MetadataCache is never updated. > When the first producer requests come through, in > KafkaApis.handleTopicMetadataRequest > the MetadataCache is empty and so we get UNKNOWN_TOPIC_OR_PARTITION. > ================================ > configuration used: > server.properties: > listeners=PLAINTEXT://:9092,SASL_PLAINTEXT://:9093 > sasl.enabled.mechanisms=PLAIN > authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer > producer.properties > bootstrap.servers=localhost:9093 > security.protocol=SASL_PLAINTEXT > sasl.mechanism=PLAIN > producer jaas.conf > KafkaClient { > org.apache.kafka.common.security.plain.PlainLoginModule required > serviceName="kafka" > username="edo1" > password="edo1pwd"; > }; -- This message was sent by Atlassian JIRA (v6.3.4#6332)