Skip to content

Add a new configuration to specify the path to the kerberos ticket cache #5296

@makotonakai

Description

I'm trying to establish multiple kerberos authentication for different principals in the same fluentbit.

[OUTPUT]
  Name Kafka
  Match app
  Brokers broker-1:9092, broker-2:9092
  Topics topic-1
  rdkafka.security.protocol sasl_ssl
  rdkafka.ssl.ca.locaiton /to/path/to/ca_file
  rdkafka.kerberos.service name service-name-1
  rdkafka.sasl.mechanism GSSAPI
  rdkafka.sasl.kerberos.keytab /to/path/to/keytab-1
  rdkafka.sasl.kerberos.principal principal-1
  rdkafka.sasl.kerberos.kinit.cmd kinit -V -R -t "/to/path/to/keytab-1" -k principal-1 -c "/to/path/to/cache-1"

[OUTPUT]
  Name Kafka
  Match app
  Brokers broker-1:9092, broker-2:9092
  Topics topic-2
  rdkafka.security.protocol sasl_ssl
  rdkafka.ssl.ca.locaiton /to/path/to/ca_file
  rdkafka.kerberos.service name service-name-2
  rdkafka.sasl.mechanism GSSAPI
  rdkafka.sasl.kerberos.keytab /to/path/to/keytab-2
  rdkafka.sasl.kerberos.principal principal-2
  rdkafka.sasl.kerberos.kinit.cmd kinit -V -R -t "/to/path/to/keytab-2" -k principal-2 -c "/to/path/to/cache-2"

However, I got the following logs.

Using specified cache: /to/path/to/cache-1
Using principal: principal-1
Using keytab: /to/path/to/keytab
Authenticated to Kerberos v5

Using specified cache: /to/path/to/cache-2
Using principal: principal-2
Using keytab: /to/path/to/keytab
Authenticated to Kerberos v5
...

No credentials were supplied, or the credentials were unavailable or inaccessible (No Kerberos credentials available (default cache: FILE:/tmp/krbcc_0)

This happens because the default location is referred, even though the ticket caches are created in different locations.

It would be nice if there is an option to specify the location of the ticket cache (e.g. rdkafka.sasl.kerberos.cache.location) for each authentication.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions