Docker环境下ksqldb BASIC身份认证配置方法及异常问题解决

我参考官方文档尝试配置ksqldb的Basic认证，初始docker-compose配置如下：

version: '3.4'

services:
  zookeeper:
    image: 'bitnami/zookeeper:latest'
    ports:
      - '2181:2181'
    environment:
      - ALLOW_ANONYMOUS_LOGIN=yes

  broker01:
    image: 'bitnami/kafka:latest'
    ports:
      - '29092:29092'
    environment:
      - KAFKA_BROKER_ID=1
      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CLIENT:PLAINTEXT,EXTERNAL:PLAINTEXT
      - KAFKA_CFG_LISTENERS=CLIENT://broker01:9092,EXTERNAL://broker01:29092
      - KAFKA_CFG_ADVERTISED_LISTENERS=CLIENT://broker01:9092,EXTERNAL://localhost:29092
      - KAFKA_INTER_BROKER_LISTENER_NAME=CLIENT
      - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181
      - ALLOW_PLAINTEXT_LISTENER=yes
    depends_on:
      - zookeeper

  ksqldb-server:
    image: confluentinc/ksqldb-server:0.21.0
    hostname: ksqldb-server
    container_name: ksqldb-server
    depends_on:
      - broker01
      - connect
    ports:
      - "8088:8088"
    environment:
      KSQL_CONFIG_DIR: "/etc/ksql"
      KSQL_BOOTSTRAP_SERVERS: "broker01:9092"
      KSQL_HOST_NAME: ksqldb-server      
      KSQL_KSQL_CONNECT_URL: "http://connect:8083"
      KSQL_LISTENERS: "http://0.0.0.0:8088"
      KSQL_CACHE_MAX_BYTES_BUFFERING: 0
      KSQL_SASL_MECHANISM: PLAIN
      KSQL_OPTS: "-Dauthentication.method=BASIC -Dauthentication.realm=KsqlServer-Props -Dauthentication.roles=admin,user,ksql,cli -Djava.security.auth.login.config=/etc/ksqldb/jaas_config.file"

  ksqldb-cli:
    image: confluentinc/ksqldb-cli:0.21.0
    depends_on:
      - broker01
      - ksqldb-server
    entrypoint: /bin/sh
    tty: true

执行以下命令启动服务：

docker compose up -d

随后通过Powershell执行命令进入ksqldb-server容器的bash环境：

docker exec -it $(docker ps -q -f name=ksqldb-server) bash

在容器内执行以下命令创建配置文件：

cd ../../etc/ksqldb

echo "KsqlServer-Props {
  org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
  file=\"/etc/ksqldb/password-file\"
  debug=\"false\";
};" >> jaas_config.file

echo "fred: MD5:0d107d09f5bbe40cade3de5c71e9e9b7,user,admin" >> password-file

完成配置后使用ksqldb-cli连接服务时返回未授权错误，执行命令如下：

docker exec -it $(docker ps -q -f name=ksqldb-cli) ksql --user fred --password letmein http://192.168.11.215:8088

错误提示为：Couldn't connect to the KSQL server: Unauthorized
查看ksqldb服务日志如下：

[2021-10-07 18:36:31,737] ERROR Failed to create LoginContext. java.io.IOException: Configuration Error:
Line 4: expected [option key] (io.confluent.ksql.api.auth.JaasAuthProvider:115)
[2021-10-07 18:36:31,739] ERROR Failed to handle request 401 /info (io.confluent.ksql.api.server.FailureHandler:38)
io.vertx.ext.web.handler.impl.HttpStatusException: Unauthorized
Caused by: io.vertx.core.impl.NoStackTraceThrowable: Failed to create LoginContext.
[2021-10-07 18:36:31,759] WARN 172.30.0.1 - - [Thu, 7 Oct 2021 18:36:31 GMT] "GET /info HTTP/1.1" 401 69 "-" "-" 0 (io.confluent.ksql.api.server.LoggingHandler:111)
[2021-10-07 18:36:31,864] ERROR Failed to create LoginContext. java.io.IOException: Configuration Error:
Line 4: expected [option key] (io.confluent.ksql.api.auth.JaasAuthProvider:115)
[2021-10-07 18:36:31,865] ERROR Failed to handle request 401 /info (io.confluent.ksql.api.server.FailureHandler:38)
io.vertx.ext.web.handler.impl.HttpStatusException: Unauthorized
Caused by: io.vertx.core.impl.NoStackTraceThrowable: Failed to create LoginContext.
[2021-10-07 18:36:31,866] WARN 172.30.0.1 - - [Thu, 7 Oct 2021 18:36:31 GMT] "GET /info HTTP/1.1" 401 69 "-" "-" 0 (io.confluent.ksql.api.server.LoggingHandler:111)

求可正常运行的ksqldb BASIC认证配置示例。 #

问题已解决 #

给ksqldb-server容器新增卷挂载配置，将jaas_config.file和password-file放到本地挂载目录中，重启容器后即可正常通过ksqldb-cli登录，挂载配置如下：

volumes:
      - "C:/data:/etc/ksqldb/jaas/"

内容的提问来源于stack exchange，提问作者Kubus