From 1c353da2e17a328a4ba52e79cbfb487c6a68aa4f Mon Sep 17 00:00:00 2001 From: Marius Bogoevici Date: Tue, 23 Aug 2016 11:27:25 -0400 Subject: [PATCH] Add security usage example Fixes #25 Addressing PR comments --- .../src/main/asciidoc/overview.adoc | 38 ++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/spring-cloud-stream-binder-kafka-docs/src/main/asciidoc/overview.adoc b/spring-cloud-stream-binder-kafka-docs/src/main/asciidoc/overview.adoc index c56052fa5..c3de127c4 100644 --- a/spring-cloud-stream-binder-kafka-docs/src/main/asciidoc/overview.adoc +++ b/spring-cloud-stream-binder-kafka-docs/src/main/asciidoc/overview.adoc @@ -63,6 +63,11 @@ spring.cloud.stream.kafka.binder.defaultZkPort:: This sets the default port when no port is configured in the node list. + Default: `2181`. +spring.cloud.stream.kafka.binder.configuration:: + Key/Value map of client properties (both producers and consumer) passed to all clients created by the binder. +Due to the fact that these properties will be used by both producers and consumers, usage should be restricted to common properties, especially security settings. ++ +Default: Empty map. spring.cloud.stream.kafka.binder.headers:: The list of custom headers that will be transported by the binder. + @@ -181,4 +186,35 @@ Exercise caution when configuring both `minPartitionCount` for a binder and `par If a topic already exists with a smaller partition count and `autoAddPartitions` is disabled (the default), then the binder will fail to start. If a topic already exists with a smaller partition count and `autoAddPartitions` is enabled, new partitions will be added. If a topic already exists with a larger number of partitions than the maximum of (`minPartitionCount` and `partitionCount`), the existing partition count will be used. -==== \ No newline at end of file +==== + +=== Usage examples + +In this section, we illustrate the use of the above properties for specific scenarios. + +==== Example: security configuration + +Apache Kafka 0.9 supports secure connections between client and brokers. +To take advantage of this feature, follow the guidelines in the http://kafka.apache.org/090/documentation.html#security_configclients[Apache Kafka Documentation], using the `spring.cloud.stream.kafka.binder.configuration` option to set security properties for all clients created by the binder. + +For example, for setting `security.protocol` to `SASL_SSL`, set: + +[source] +---- +spring.cloud.stream.kafka.binder.configuration.security.protocol=SASL_SSL +---- + +All the other security properties can be set in a similar manner. + +When using Kerberos, follow the instructions in the http://kafka.apache.org/090/documentation.html#security_sasl_clientconfig[reference documentation] for creating and referencing the JAAS configuration. +At the time of this release, the JAAS, and (optionally) krb5 file locations must be set for Spring Cloud Stream applications by using system properties. +Here is an example of launching a Spring Cloud Stream application with SASL and Kerberos. + +[source] +---- + java -Djava.security.auth.login.config=/path.to/kafka_client_jaas.conf -jar log.jar \\ + --spring.cloud.stream.kafka.binder.brokers=secure.server:9092 \\ + --spring.cloud.stream.kafka.binder.zkNodes=secure.zookeeper:2181 \\ + --spring.cloud.stream.bindings.input.destination=stream.ticktock \\ + --spring.cloud.stream.kafka.binder.clientConfiguration.security.protocol=SASL_PLAINTEXT +----