Failed to start broker after enabling Zookeeper Authentication - authentication

Question

Started Zookeeper with the following properties ie zookeeper.properties
dataDir=/tmp/zookeepeeer
clientPort=2186
maxClientCnxns=0
auto.offset.reset=smallest
authProvider.1=org.apache.zookeeper.server.auth.DigestAuthenticationProvider
jaasLoginRenew=3600000
requireClientAuthScheme=sasl
zookeeper_jaas.conf
Server {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret"
user_admin="admin-secret";
};
Server.properties
group.initial.rebalance.delay.ms=0
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
listeners=SASL_PLAINTEXT://localhost:9092
security.inter.broker.protocol= SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.enabled.mechanisms=PLAIN
super.users=User:admin
zookeeper.set.acl=true
Kafka_server_jaaz.conf
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret"
user_admin="admin-secret";
};
The error is as follows
java.lang.SecurityException: zookeeper.set.acl is true, but the verification of the JAAS login file failed.
I have tried the below solution but it again fails with the following error inspite of doing the changes
kafka_server_jaaz.conf
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret"
user_admin="admin-secret";
};
Client {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret";
};
The server.properties is the same as above
But it fails with the following error:
[2018-02-23 10:16:04,459] ERROR Invalid ACL (kafka.utils.ZKCheckedEphemeral)
[2018-02-23 10:16:04,459] ERROR Invalid ACL (kafka.utils.ZKCheckedEphemeral)
[2018-02-23 10:16:04,460] FATAL [Kafka Server 0], Fatal error during KafkaServer
startup. Prepare to shutdown (kafka.server.KafkaServer)
org.I0Itec.zkclient.exception.ZkException:
org.apache.zookeeper.KeeperException$InvalidACLException: KeeperErrorCode = InvalidACL

Answer 1

In Kafka you also need to configure the SASL client which will be used when connecting to Zookeeper. This is done using the Client context in the Kafka JAAS config, e.g.
Client {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="admin-secret";
};
If needed, the context name can be changed using the zookeeper.sasl.clientconfig system property.