Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
IronPort-PHdr: =?us-ascii?q?9a23=3AfnCIDRLxOPzMm//bMtmcpTZWNBhigK39O0sv0rFi?=
 =?us-ascii?q?tYgXI//xwZ3uMQTl6Ol3ixeRBMOAtKIC1rKempujcFJDyK7JiGoFfp1IWk1Nou?=
 =?us-ascii?q?QttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBWB6kG1uHQPARjlHRhy?=
 =?us-ascii?q?Ief4F5bflYK+z+m5+5CVZB9HznLpfKh/Nj2kqgLSu8QOjJEkI744wRvE5HxSdL?=
 =?us-ascii?q?IF63lvIAeonwz95c624NZb+jhdv7p1zPZJTaj+V7w0Xb1eB3ItNGVjt56jjgXK?=
 =?us-ascii?q?UQbavihUaW4RiBcdWwU=3D?=
From: Shrikant Patel <SPatel@pdxinc.com>
To: "user@zookeeper.apache.org" <user@zookeeper.apache.org>
Subject: Help with SASL configuration for Zookeeper on the Microsoft AD.
Thread-Topic: Help with SASL configuration for Zookeeper on the Microsoft AD.
Thread-Index: AdKdp5n8+ZIx8uYlSOqMm0tJNjTIgw==
Date: Wed, 15 Mar 2017 16:40:49 +0000
Message-ID: <DM5PR02MB24924E5648188B2C7B427273A2270@DM5PR02MB2492.namprd02.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
	boundary="_000_DM5PR02MB24924E5648188B2C7B427273A2270DM5PR02MB2492namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2017 16:40:49.0521
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 1b86eb97-f43d-4829-8971-c02918e1341f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR02MB2490
archived-at: Wed, 15 Mar 2017 16:43:30 -0000

--_000_DM5PR02MB24924E5648188B2C7B427273A2270DM5PR02MB2492namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi

Has anyone experience with securing Kafka to Zookeeper configuration and se=
tting up SASL on Microsoft AD account.

We create keytab and principal for Kafka and ZK using https://www.confluent=
.io/blog/apache-kafka-security-authorization-authentication-encryption/

We see these principal in our AD. When ZK and Kafka are launched they are a=
ble to connect to Kerberos \ AD server using their individual keytabs. But =
when Kafka tries to request service ticket for ZK from Kerberos, it errors =
out using below error.

>>>KRBError:
         sTime is Fri Feb 10 11:48:41 CST 2017 1486748921000
         suSec is 282568
         error code is 7
         error Message is Server not found in Kerberos database
         sname is zk/XXXX.XXXXX.com@XXX.COM
         msgType is 30

(https://issues.apache.org/jira/browse/ZOOKEEPER-1811 , as per this we have=
 set zookeeper.sasl.client.username so that zk is used for zookeeper name)

It seems the issue is we may not setup SPN (servive profile name) correct, =
or link the user account\keytab to the SPN.

We have spent good amount of time with our IT\AD team on this. We are ready=
 to provide some monetary incentive to anyone if they help us resolve this =
issue.

Thanks,
Shri

This e-mail and its contents (to include attachments) are the property of N=
ational Health Systems, Inc., its subsidiaries and affiliates, including bu=
t not limited to Rx.com Community Healthcare Network, Inc. and its subsidia=
ries, and may contain confidential and proprietary or privileged informatio=
n. If you are not the intended recipient of this e-mail, you are hereby not=
ified that any unauthorized disclosure, copying, or distribution of this e-=
mail or of its attachments, or the taking of any unauthorized action based =
on information contained herein is strictly prohibited. Unauthorized use of=
 information contained herein may subject you to civil and criminal prosecu=
tion and penalties. If you are not the intended recipient, please immediate=
ly notify the sender by telephone at 800-433-5719 or return e-mail and perm=
anently delete the original e-mail.

--_000_DM5PR02MB24924E5648188B2C7B427273A2270DM5PR02MB2492namp_--