Anonymitaet commented on a change in pull request #4771: Improve kerberos
documents
URL: https://github.com/apache/pulsar/pull/4771#discussion_r306109700
##########
File path: site2/docs/security-kerberos.md
##########
@@ -312,13 +344,52 @@ For example:
superUserRoles=client/{clientIp}@EXAMPLE.COM
```
-## Regarding authorization between BookKeeper and ZooKeeper
+## 4. Regarding authentication between ZooKeeper and Broker
-Adding `bookkeeperClientAuthenticationPlugin` parameter in `broker.conf` is a
prerequisite for Broker (as a Kerberos client) being authenticated by Bookie
(as a Kerberos Server):
+Pulsar Broker acts as a Kerberos client when authenticating with Zookeeper.
According to [ZooKeeper
document](https://cwiki.apache.org/confluence/display/ZOOKEEPER/Client-Server+mutual+authentication),
you need these settings in `conf/zookeeper.conf`:
+
+```
+authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
+requireClientAuthScheme=sasl
+```
+
+And add a section of `Client` configurations, which use in the
`pulsar_jaas.conf` that used by Pulsar Broker:
+
+```
+ Client {
+ com.sun.security.auth.module.Krb5LoginModule required
+ useKeyTab=true
+ storeKey=true
+ useTicketCache=false
+ keyTab="/etc/security/keytabs/pulsarbroker.keytab"
+ principal="broker/[email protected]";
+};
+```
+
+In this setting, Pulsar Broker's principal and keyTab file indicates Broker's
role when authenticating with ZooKeeper.
+
+## 5. Regarding authentication between BookKeeper and Broker
+
+Pulsar Broker acts as a Kerberos client when authenticating with Bookie.
According to [BookKeeper
document](http://bookkeeper.apache.org/docs/latest/security/sasl/), you need
add `bookkeeperClientAuthenticationPlugin` parameter in `broker.conf`:
```
bookkeeperClientAuthenticationPlugin=org.apache.bookkeeper.sasl.SASLClientProviderFactory
```
-For more details of how to configure Kerberos for BookKeeper and Zookeeper,
refer to [BookKeeper
document](http://bookkeeper.apache.org/docs/latest/security/sasl/).
+In this setting, `SASLClientProviderFactory` will create a BookKeeper SASL
client in Broker, and use this client authenticate with Bookie node.
Review comment:
```suggestion
In this setting, `SASLClientProviderFactory` will create a BookKeeper SASL
client in Broker, and use this client to authenticate with a Bookie node.
```
Who uses this client?
What is "this client"? `SASLClientProviderFactory`?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
