How to configure multiple keytab files for different Kafka topics

General
, , , , ,
1

We have a few Kafka topics to consume in Pega; however, each topic has access to a different keytab file. Essentially, the keytab is not the same for all topics.

For example, kafka_topic1 has access to kafka_keytab1, and kafka_topic2 has access to kafka_keytab2. We need to consume these two topics in the same Pega application, and the keytab files are located in the same server location.

I have attempted to set up two JAAS configurations in the JVM settings as follows, but Pega does not recognize the second JAAS configuration for the second topic.

The configuration for the first client is -djava.security.auth.login.config=xxx/jaas1.conf, and for the second client, it’s -djava.security.auth.login.config=xxx/jaas2.conf.

Is there another way to accomplish this?

2

@KasunJ Just a suggestion, haven’t tried it personally.

JAAS Login Configuration File (oracle.com)

Java security properties file will allow multiple configurations

2. In the Java security properties file.

An alternate approach to specifying the location of the login configuration file is to indicate its URL as the value of a login.config.url.n property in the security properties file.
3

@KasunJ

Basically, you can create two Kafka rules for this, such as kafka_abc and kafka_xyz. Thereafter, create two Kafka client properties files as below. All JAAS file configurations can be included in sasl.jaas.config. However, make sure to follow the format below.

In this example

File : Kafka_ABC.properties

sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab=“F:/PegaConfig/Kafka_ABC.keytab” storeKey=true useTicketCache=false serviceName=“kafka” principal="[email protected]";

File : Kafka_XYZ.properties

sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab=“F:/PegaConfig/Kafka_XYZ.keytab” storeKey=true useTicketCache=false serviceName=“kafka” principal="[email protected]";

Here’s an example for Kafka_ABC :

bootstrap.servers=localhost:9092
sasl.jaas.config=com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab=“F:/PegaConfig/Kafka_ABC.keytab” storeKey=true useTicketCache=false serviceName=“kafka” principal="[email protected]";

Upload the Kafka client property file to the Kafka rule under the Advanced Configuration section.