Authentication using TLS

    Pulsar 使用了 提供的 TLS 相关的密码套件和算法。 如果你需要 FIPS 版本的 Bouncy Castle Provider，请参考 。

    Client certificates are generated using the certificate authority. Server certificates are also generated with the same certificate authority.

    The biggest difference between client certs and server certs is that the common name for the client certificate is the role token which that client is authenticated as.

    To use client certificates, you need to set tlsRequireTrustedClientCertOnConnect=true at the broker side. For details, refer to TLS broker configuration.

    首先，你需要输入文件夹命令才能生成密钥：

    1. $ openssl pkcs8 -topk8 -inform PEM -outform PEM \
    2.       -in admin.key.pem -out admin.key-pk8.pem -nocrypt

    接下来，输入下面的命令来生成证书请求。 When you are asked for a common name, enter the role token that you want this key pair to authenticate a client as.

    1. $ openssl req -config openssl.cnf \
    2.       -key admin.key.pem -new -sha256 -out admin.csr.pem

    然后输入下面的命令来与证书权威签约。 Note that the client certs uses the usr_cert extension, which allows the cert to be used for client authentication.

    1. $ openssl ca -config openssl.cnf -extensions usr_cert \
    2.       -days 1000 -notext -md sha256 \
    3.       -in admin.csr.pem -out admin.cert.pem

    你可以从此命令获得证书、 admin.cert.pem和一个密钥。 admin.key-pk8.pem 使用 ca.cert. em， 客户可以使用此证书和此密钥向 broker 和 proxy 进行身份验证，作为 管理员

    Note If the “unable to load CA private key” error occurs and the reason of this error is “No such file or directory: /etc/pki/CA/private/cakey.pem” in this step. Try the command below:

    要配置 broker 来验证客户端，请在 broker.conf中添加以下参数，和 ：

    1. # Configuration to enable authentication
    2. authenticationEnabled=true
    3. authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls
    5. # operations and publish/consume from all topics
    6. superUserRoles=admin
    8. brokerClientTlsEnabled=true
    9. brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
    10. brokerClientAuthenticationParameters={"tlsCertFile":"/path/my-ca/admin.cert.pem","tlsKeyFile":"/path/my-ca/admin.key-pk8.pem"}

    要配置 proxy 服务器来验证客户端，请在 代理.conf的配置中加上 来启用tls transport:

    代理服务器应该有自己的客户端密钥对。 你需要在 broker 的 代理角色 中配置此密钥对的角色标记。 详情请访问 。

    1. # For clients connecting to the proxy
    2. authenticationEnabled=true
    3. authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls
    5. # For the proxy to connect to brokers
    6. brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
    7. brokerClientAuthenticationParameters=tlsCertFile:/path/to/proxy.cert.pem,tlsKeyFile:/path/to/proxy.key-pk8.pem

    When you use TLS authentication, client connects via TLS transport. You need to configure the client to use https:// and 8443 port for the web service URL, pulsar+ssl:// and 6651 port for the broker service URL.

    命令行工具

    pulsar-admin, pulsar-client 使用 conf/client. onf 配置文件在 Pulsar 安装中。

    1. webServiceUrl=https://broker.example.com:8443/
    2. brokerServiceUrl=pulsar+ssl://broker.example.com:6651/
    3. useTls=true
    4. tlsAllowInsecureConnection=false
    5. tlsTrustCertsFilePath=/path/to/ca.cert.pem
    6. authPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
    7. authParams=tlsCertFile:/path/to/my-role.cert.pem,tlsKeyFile:/path/to/my-role.key-pk8.pem

    Python client

    1. from pulsar import Client, AuthenticationTLS
    3. auth = AuthenticationTLS("/path/to/my-role.cert.pem", "/path/to/my-role.key-pk8.pem")
    4. client = Client("pulsar+ssl://broker.example.com:6651/",
    6.                 tls_allow_insecure_connection=False,
    7.                 authentication=auth)
    2. pulsar::ClientConfiguration config;
    3. config.setUseTls(true);
    4. config.setTlsTrustCertsFilePath("/path/to/ca.cert.pem");
    5. config.setTlsAllowInsecureConnection(false);
    7. pulsar::AuthenticationPtr auth = pulsar::AuthTls::create("/path/to/my-role.cert.pem",
    8.                                                          "/path/to/my-role.key-pk8.pem")
    9. config.setAuth(auth);
    11. pulsar::Client client("pulsar+ssl://broker.example.com:6651/", config);

    Node.js 客户端

    1. const Pulsar = require('pulsar-client');
    3. (async () => {
    4.   const auth = new Pulsar.AuthenticationTls({
    5.     certificatePath: '/path/to/my-role.cert.pem',
    6.     privateKeyPath: '/path/to/my-role.key-pk8.pem',
    7.   });
    9.   const client = new Pulsar.Client({
    10.     serviceUrl: 'pulsar+ssl://broker.example.com:6651/',
    11.     authentication: auth,
    12.     tlsTrustCertsFilePath: '/path/to/ca.cert.pem',
    14. })();