https://cwiki.apache.org/confluence/display/ZOOKEEPER/Server-Server+mutual+authentication 官网
https://article.itxueyuan.com/ylgo9Q
sessionRequireClientSASLAuth=true #客户端必须 SASL 认证
principal="zk-server/pxc1@ABC.COM"; #这里不同的主机上,需修改为本机的主机名
export SERVER_JVMFLAGS="-Djava.security.auth.login.config=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/jaas.conf -Djava.security.krb5.conf=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/krb5.conf"
export CLIENT_JVMFLAGS="${CLIENT_JVMFLAGS} -Djava.security.auth.login.config=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/jaas.conf -Djava.security.krb5.conf=/home/hadoop/app/apache-zookeeper-3.6.3-bin/conf/krb5.conf -Dzookeeper.server.principal=zk-server/pxc1@ABC.COM" #这里不同的主机上,需修改为本机的主机名
https://blog.csdn.net/zhanglong_4444/article/details/118893733
主要用于问题定位&联调,
kdc服务日志 : 默认 /var/log/krb5kdc.log
server端日志: 默认 在${ZOOKEEPER_HOME}\bin\zookeeper.out文件中.
client端日志: 直接是在控制台输出的. 如果想看kerberos相关的信息, 查看 [2.5章节] 设置JVM参数 -Dsun.security.krb5.debug=true
https://www.jianshu.com/p/23c08900f44e(这个文档估计能解决问题)
修改zoo.cfg配置
authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
jaasLoginRenew=3600000
kerberos.removeHostFromPrincipal=true
sasl.enabled.mechanisms=GSSAPI
requireClientAuthScheme=sasl
修改环境变量
bin/zkServer.sh