Github user nickwallen commented on the issue:
https://github.com/apache/incubator-metron/pull/507
The issues that I am having currently are with Quick Dev. But I have
actually been able to do this on a separate cluster in a slightly different
way. On the other cluster, I did not use the `--group` option when setting the
ACL. If I did set the group, then I had to ensure that the group matched what
was used by the `kafka-console-producer`.
So as a test, I granted access without the `--group`.
1. Grant access. Look ma, no group.
```
[root@node1 ~]# kafka-acls.sh --authorizer
kafka.security.auth.SimpleAclAuthorizer --authorizer-properties
zookeeper.connect=node1:2181 --add --allow-principal User:metron --topic yaf
Adding ACLs for resource `Topic:yaf`:
User:metron has Allow permission for operations: All from hosts: *
Current ACLs for resource `Topic:yaf`:
User:metron has Allow permission for operations: All from hosts: *
```
2. Validate the ACL. Looks good this time.
```
[root@node1 ~]# kafka-acls.sh --list --topic yaf --authorizer-properties
zookeeper.connect=node1:2181 --authorizer
kafka.security.auth.SimpleAclAuthorizer
Current ACLs for resource `Topic:yaf`:
User:metron has Allow permission for operations: All from hosts: *
```
3. And now I can send data successfully.
```
[root@node1 ~]# echo "foo" | kafka-console-producer.sh --broker-list
node1:6667 --topic yaf --security-protocol SASL_PLAINTEXT
[2017-04-07 17:05:28,830] WARN The TGT cannot be renewed beyond the next
expiry date: Sat Apr 08 16:11:26 UTC 2017.This process will not be able to
authenticate new SASL connections after that time (for example, it will not be
able to authenticate a new connection with a Kafka Broker). Ask your system
administrator to either increase the 'renew until' time by doing : 'modprinc
-maxrenewlife null ' within kadmin, or instead, to generate a keytab for null.
Because the TGT's expiry cannot be further extended by refreshing, exiting
refresh thread now. (org.apache.kafka.common.security.kerberos.KerberosLogin)
```
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
