Anonymitaet commented on a change in pull request #4771: Improve kerberos
documents
URL: https://github.com/apache/pulsar/pull/4771#discussion_r308230429
##########
File path: site2/website/versioned_docs/version-2.4.0/security-kerberos.md
##########
@@ -313,13 +345,51 @@ For example:
superUserRoles=client/{clientIp}@EXAMPLE.COM
```
-## Regarding authorization between BookKeeper and ZooKeeper
+## Regarding authentication between ZooKeeper and Broker
+
+Pulsar Broker acts as a Kerberos client when authenticating with Zookeeper.
According to [ZooKeeper
document](https://cwiki.apache.org/confluence/display/ZOOKEEPER/Client-Server+mutual+authentication),
you need these settings in `conf/zookeeper.conf`:
+
+```
+authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
+requireClientAuthScheme=sasl
+```
+
+And add a section of `Client` configurations in the file `pulsar_jaas.conf`,
which is used by Pulsar Broker:
+
+```
+ Client {
+ com.sun.security.auth.module.Krb5LoginModule required
+ useKeyTab=true
+ storeKey=true
+ useTicketCache=false
+ keyTab="/etc/security/keytabs/pulsarbroker.keytab"
+ principal="broker/[email protected]";
+};
+```
+
+In this setting, Pulsar Broker's principal and keyTab file indicates Broker's
role when authenticating with ZooKeeper.
+
+## Regarding authentication between BookKeeper and Broker
-Adding `bookkeeperClientAuthenticationPlugin` parameter in `broker.conf` is a
prerequisite for Broker (as a Kerberos client) being authenticated by Bookie
(as a Kerberos Server):
+Pulsar Broker acts as a Kerberos client when authenticating with Bookie.
According to [BookKeeper
document](http://bookkeeper.apache.org/docs/latest/security/sasl/), you need to
add `bookkeeperClientAuthenticationPlugin` parameter in `broker.conf`:
```
bookkeeperClientAuthenticationPlugin=org.apache.bookkeeper.sasl.SASLClientProviderFactory
```
-For more details of how to configure Kerberos for BookKeeper and Zookeeper,
refer to [BookKeeper
document](http://bookkeeper.apache.org/docs/latest/security/sasl/).
+In this setting, `SASLClientProviderFactory` will create a BookKeeper SASL
client in Broker, and Broker use created SASL client to authenticate with a
Bookie node.
Review comment:
```suggestion
In this setting, `SASLClientProviderFactory` creates a BookKeeper SASL
client in a broker, and the broker uses the created SASL client to authenticate
with a bookie node.
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
