Jia Zhai jiazhai

Steps for KoP authentication and authorization Based on JWT.

Please reference to Pulsar Security Overview to understand the Pulsar authen and author. Currently KoP support Pulsar Token auth

Before start, preparing a KoP tar ball and a Pulsar tar ball(mainly use puslar-admin tools in this tar ball).

Some background before tutorial

In KoP, we currently support SASL_PLAINTEXT, in which a username/password pair needs provide. We reused the Token provider in Pulsar to implement a KoP SASL authentication, the authorization still use Pulsar authorization.

KOP support Kafka listeners config of type "PLAINTEXT" and "SSL". You could set config like listeners=PLAINTEXT://localhost:9092,SSL://localhost:9093. Please reference Kafka SSL document for how to config SSL keys. Here is some steps that you need to be able to connect KOP through SSL.

create SSL related Keys.

Here is an example of a bash script to create related CA and jks files.

	#
	# Licensed to the Apache Software Foundation (ASF) under one
	# or more contributor license agreements. See the NOTICE file
	# distributed with this work for additional information
	# regarding copyright ownership. The ASF licenses this file
	# to you under the Apache License, Version 2.0 (the
	# "License"); you may not use this file except in compliance
	# with the License. You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0

	#
	# Licensed to the Apache Software Foundation (ASF) under one
	# or more contributor license agreements. See the NOTICE file
	# distributed with this work for additional information
	# regarding copyright ownership. The ASF licenses this file
	# to you under the Apache License, Version 2.0 (the
	# "License"); you may not use this file except in compliance
	# with the License. You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0