Enable or disable authentication with delegation tokens
Learn how to enable or disable Kafka delegation tokens.
Delegation token based authentication requires that both the Enable Kerberos Authentication and Enable Delegation Tokens properties are set to true. The default value of the Enable Delegation Tokens property is true, but will have no effect until Kerberos is also enabled.
Although enabling delegation tokens enables authentication between clients and servers using the SASL/SCRAM mechanism, it is only as a vehicle for delegation tokens. Using SCRAM credentials is not supported otherwise.
Sensitive delegation token metadata is stored in Zookeeper. It is recommended to restrict access on Zookeeper nodes to prevent access to sensitive delegation token related data through Zookeeper. The connection between Kafka and Zookeeper is not encrypted, therefore, it is also recommended to use delegation tokens only if no unauthorized person can read and manipulate the traffic between these services.
Delegation tokens can be enabled separately for each Kafka service.
A secure Kafka cluster with Kerberos authentication enabled is required for delegation tokens to function.
- In Cloudera Manager select the Kafka service.
- Select Configuration and find the Enable Delegation Tokens property.
- Enable or disable delegation tokens for all required services by checking or unchecking the checkbox next to the name of the service.
- Click Save Changes.
- Perform a Rolling Restart:
- Return to the Home page by clicking the Cloudera Manager logo.
- Go to the Kafka service and select .
- Check the Restart roles with stale configurations only checkbox and click Rolling restart.
- Click Close when the restart has finished.
