search

dajudge / kafkaproxy

kafkaproxy is a reverse proxy for the wire protocol of Apache Kafka.
Apache License 2.0
72 stars 10 forks source link

Support MSK IAM Auth #36

Open leowmjw opened 3 years ago

leowmjw commented 3 years ago

Would like to request support for MSK IAM Auth --> https://github.com/aws/aws-msk-iam-auth

I was trying to look through the code but it was not clear if the above is supported; did not see how to pass in more config that can be done using normal kafka client config.

Is there an easy way to pass the config for connection from proxy to broker as per article --> https://aws.amazon.com/blogs/big-data/securing-apache-kafka-is-easy-and-familiar-with-iam-access-control-for-amazon-msk/:

Then you specify the necessary Kafka properties:

ssl.truststore.location=<PATH_TO_TRUST_STORE_FILE>
security.protocol=SASL_SSL
sasl.mechanism=AWS_MSK_IAM
sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule required; sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandler
mhmcdonald commented 3 years ago

I also haven't been able to figure this out yet

dajudge commented 3 years ago

I don't have MSK instances to work with, but should you end up with a working solution a PR would certainly be welcome.

kidpollo commented 3 years ago

Support for confluent cloud SASL plain mechanism would be great too :D

bootstrap.servers=<broker-list>
broker.address.ttl=30000
api.version.request=true
api.version.fallback.ms=0
broker.version.fallback=0.10.0.0
security.protocol=SASL_SSL
ssl.ca.location=/usr/local/etc/openssl/cert.pem
sasl.mechanisms=PLAIN
sasl.username=<api-key>
sasl.password=<api-secret>
session.timeout.ms=45000
simonkarman commented 2 years ago

@dajudge the aws-msk-iam-auth adds support for MSK Auth, which is build on top of SASL auth. Do you think that this can be added to this project?

PS: I also added an issue in the aws-msk-iam-auth repo.