Kafka SASL Auth with Kerberos: How to clear credentials cache

Viewed 178

I have a Java application that connects to Kafka through KafkaAdminClient. I'm using SASL authentication with GSSAPI mechanism (Kerberos). I am providing the krb5.conf, jaas.conf, principal, and keytab. When the application starts, if I provide the correct principal and keytab, and the first authentication attempt is successful, every subsequent attempt will remain successful, even if I change the principal/keytab to be incorrect. The reverse scenario is also true; if the principal in the first attempt is incorrect, causing a failure, every subsequent attempt also fails even after I correct the principal. I realize this is because Kerberos caches credentials; I'm wondering how to clear the cache without restarting the app. Can I force the principal to log off after a period of time?

I have tried setting various properties in the conf files with no luck. This is what I have:

jaas.conf

KafkaClient {
    com.sun.security.auth.module.Krb5LoginModule required
    renewTicket=false
    useKeyTab=true
    storeKey=false
    useTicketCache=false
    remewTGT=false
    refreshKrb5Config=true
    keyTab="/tmp/keytab.keytab"
    principal="***"
    serviceName="kafka";
};
Client {
    com.sun.security.auth.module.Krb5LoginModule required
    renewTicket=false
    useKeyTab=true
    storeKey=false
    useTicketCache=false
    remewTGT=false
    refreshKrb5Config=true
    keyTab="/tmp/keytab.keytab"
    principal="***"
    serviceName="zookeeper";
};

krb5.conf

[libdefaults]
  forwardable = true
  default_realm = foo.bar.com
  ticket_lifetime = 24h
  dns_lookup_realm = false
  dns_lookup_kdc = false
  default_ccache_name = /tmp/krb5cc_%{uid}
  rdns = false
  ignore_acceptor_hostname = true
  udp_preference_limit = 1
  #default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
  #default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5

[domain_realm]
  ******.*****.*****.****.com = foo.bar.com

[logging]
  default = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
  kdc = FILE:/var/log/krb5kdc.log

[realms]
 foo.bar.com = {
  kdc = ******.*****.*****.****.com
  admin_server = ********.******.******.*****.com
  admin_server = ********.******.******.*****.com
 }

This application is deployed to PCF and I cannot ssh into the instance, so doing a klist purge is not an option. Is there another way to make Kerberos forget previous logins? Any suggestions are greatly appreciated.

0 Answers
Related