Anonymitaet commented on a change in pull request #4771: Improve kerberos
documents
URL: https://github.com/apache/pulsar/pull/4771#discussion_r306109613
##########
File path: site2/docs/security-kerberos.md
##########
@@ -312,13 +344,52 @@ For example:
superUserRoles=client/{clientIp}@EXAMPLE.COM
```
-## Regarding authorization between BookKeeper and ZooKeeper
+## 4. Regarding authentication between ZooKeeper and Broker
-Adding `bookkeeperClientAuthenticationPlugin` parameter in `broker.conf` is a
prerequisite for Broker (as a Kerberos client) being authenticated by Bookie
(as a Kerberos Server):
+Pulsar Broker acts as a Kerberos client when authenticating with Zookeeper.
According to [ZooKeeper
document](https://cwiki.apache.org/confluence/display/ZOOKEEPER/Client-Server+mutual+authentication),
you need these settings in `conf/zookeeper.conf`:
+
+```
+authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
+requireClientAuthScheme=sasl
+```
+
+And add a section of `Client` configurations, which use in the
`pulsar_jaas.conf` that used by Pulsar Broker:
+
+```
+ Client {
+ com.sun.security.auth.module.Krb5LoginModule required
+ useKeyTab=true
+ storeKey=true
+ useTicketCache=false
+ keyTab="/etc/security/keytabs/pulsarbroker.keytab"
+ principal="broker/[email protected]";
+};
+```
+
+In this setting, Pulsar Broker's principal and keyTab file indicates Broker's
role when authenticating with ZooKeeper.
+
+## 5. Regarding authentication between BookKeeper and Broker
+
+Pulsar Broker acts as a Kerberos client when authenticating with Bookie.
According to [BookKeeper
document](http://bookkeeper.apache.org/docs/latest/security/sasl/), you need
add `bookkeeperClientAuthenticationPlugin` parameter in `broker.conf`:
Review comment:
```suggestion
Pulsar Broker acts as a Kerberos client when authenticating with Bookie.
According to [BookKeeper
document](http://bookkeeper.apache.org/docs/latest/security/sasl/), you need to
add `bookkeeperClientAuthenticationPlugin` parameter in `broker.conf`:
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
