{"action":"created","comment":{"url":"https://api.github.com/repos/confluentinc/schema-registry/pulls/comments/66482800","id":66482800,"diff_hunk":"@@ -2,13 +2,29 @@\n \n Security Overview\n -----------------\n-The Schema Registry currently supports two security features: communication with a secure Kafka cluster over SSL; and API calls over HTTPS. At this time, ZooKeeper security and Kafka SASL authentication are not yet supported.\n+The Schema Registry currently supports all Kafka security features, including: communication and authentication with a\n+secure Kafka cluster over SSL; authentication with ZooKeeper over SASL; authentication with Kafka over SASL; and\n+end-user REST API calls over HTTPS.\n \n For more details, check the :ref:`configuration options<schemaregistry_config>`.\n \n Kafka Store\n ~~~~~~~~~~~\n-The Schema Registry uses Kafka to persist schemas. The following Kafka security configurations are currently supported:\n+The Schema Registry uses Kafka to persist schemas, and all Kafka security features are supported by the Schema Registry.\n \n-* SSL encryption\n-* SSL authentication\n+ZooKeeper\n+~~~~~~~~~\n+ZooKeeper SASL authentication is supported.\n+\n+Setting up ZooKeeper SASL authentication for the Schema Registry is similar to Kafka's setup. Namely,\n+create a keytab for the Schema Registry, create a JAAS configuration file, and set the appropriate JAAS Java properties.\n+\n+In addition to the keytab and JAAS setup, be aware of the `zookeeper.set.acl` setting. This setting, when set to `true`\n+, enables ZooKeeper ACLs, which limits access to znodes.\n+\n+Important: if `zookeeper.set.acl` is set to `true`, the Schema Registry's service name must be the same as Kafka's, which\n+is most likely `kafka`. The Schema Registry's principal must have the correct service name, too. Otherwise, the Schema\n+Registry will fail to create the `_schemas` topic, which will cause a leader not available error.","path":"docs/security.rst","position":30,"original_position":30,"commit_id":"3daa4bc539097950e66104eae1c152ab82324b3b","original_commit_id":"3daa4bc539097950e66104eae1c152ab82324b3b","user":{"login":"alexlod","id":39045,"avatar_url":"https://avatars.githubusercontent.com/u/39045?v=3","gravatar_id":"","url":"https://api.github.com/users/alexlod","html_url":"https://github.com/alexlod","followers_url":"https://api.github.com/users/alexlod/followers","following_url":"https://api.github.com/users/alexlod/following{/other_user}","gists_url":"https://api.github.com/users/alexlod/gists{/gist_id}","starred_url":"https://api.github.com/users/alexlod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexlod/subscriptions","organizations_url":"https://api.github.com/users/alexlod/orgs","repos_url":"https://api.github.com/users/alexlod/repos","events_url":"https://api.github.com/users/alexlod/events{/privacy}","received_events_url":"https://api.github.com/users/alexlod/received_events","type":"User","site_admin":false},"body":"@ewencp and I discussed this. I'm documenting our conversation here.\r\n\r\nIn the scenario where Kafka sets ZK ACLs and the Schema Registry has a different service name than Kafka, the error the user receives makes sense -- NoAuth from ZooKeeper. However, when Kafka doesn't set ZooKeeper ACLs but the Schema Registry does (and the service name is different), the error message is not intuitive. Unfortunately, the error message is set in the Kafka consumer -- we don't have control over it in the Schema Registry. As such, I added a mention of the error the user will see in the docs, hoping that people will find our docs when searching Google for the error.\r\n\r\nThanks for your suggestion and help here, @ewencp!","created_at":"2016-06-09T17:17:19Z","updated_at":"2016-06-09T17:17:19Z","html_url":"https://github.com/confluentinc/schema-registry/pull/344#discussion_r66482800","pull_request_url":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344","_links":{"self":{"href":"https://api.github.com/repos/confluentinc/schema-registry/pulls/comments/66482800"},"html":{"href":"https://github.com/confluentinc/schema-registry/pull/344#discussion_r66482800"},"pull_request":{"href":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344"}}},"pull_request":{"url":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344","id":72258439,"html_url":"https://github.com/confluentinc/schema-registry/pull/344","diff_url":"https://github.com/confluentinc/schema-registry/pull/344.diff","patch_url":"https://github.com/confluentinc/schema-registry/pull/344.patch","issue_url":"https://api.github.com/repos/confluentinc/schema-registry/issues/344","number":344,"state":"closed","locked":false,"title":"ZooKeeper and Kafka SASL support.","user":{"login":"alexlod","id":39045,"avatar_url":"https://avatars.githubusercontent.com/u/39045?v=3","gravatar_id":"","url":"https://api.github.com/users/alexlod","html_url":"https://github.com/alexlod","followers_url":"https://api.github.com/users/alexlod/followers","following_url":"https://api.github.com/users/alexlod/following{/other_user}","gists_url":"https://api.github.com/users/alexlod/gists{/gist_id}","starred_url":"https://api.github.com/users/alexlod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexlod/subscriptions","organizations_url":"https://api.github.com/users/alexlod/orgs","repos_url":"https://api.github.com/users/alexlod/repos","events_url":"https://api.github.com/users/alexlod/events{/privacy}","received_events_url":"https://api.github.com/users/alexlod/received_events","type":"User","site_admin":false},"body":"This commit has support for ZooKeeper and Kafka SASL support (and SASL_SSL in Kafka). I'll close https://github.com/confluentinc/schema-registry/pull/339 in favor of this PR.\r\n\r\nWould be great to have (@ijuma || @junrao) && (@ewencp || @granders || @Ishiihara) review this. Thanks!","created_at":"2016-06-01T21:51:32Z","updated_at":"2016-06-09T17:17:19Z","closed_at":"2016-06-08T00:04:31Z","merged_at":null,"merge_commit_sha":"b31cab9278d295b2b8a235a21273e88421af947c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344/commits","review_comments_url":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344/comments","review_comment_url":"https://api.github.com/repos/confluentinc/schema-registry/pulls/comments{/number}","comments_url":"https://api.github.com/repos/confluentinc/schema-registry/issues/344/comments","statuses_url":"https://api.github.com/repos/confluentinc/schema-registry/statuses/3daa4bc539097950e66104eae1c152ab82324b3b","head":{"label":"alexlod:sasl","ref":"sasl","sha":"3daa4bc539097950e66104eae1c152ab82324b3b","user":{"login":"alexlod","id":39045,"avatar_url":"https://avatars.githubusercontent.com/u/39045?v=3","gravatar_id":"","url":"https://api.github.com/users/alexlod","html_url":"https://github.com/alexlod","followers_url":"https://api.github.com/users/alexlod/followers","following_url":"https://api.github.com/users/alexlod/following{/other_user}","gists_url":"https://api.github.com/users/alexlod/gists{/gist_id}","starred_url":"https://api.github.com/users/alexlod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexlod/subscriptions","organizations_url":"https://api.github.com/users/alexlod/orgs","repos_url":"https://api.github.com/users/alexlod/repos","events_url":"https://api.github.com/users/alexlod/events{/privacy}","received_events_url":"https://api.github.com/users/alexlod/received_events","type":"User","site_admin":false},"repo":{"id":48070866,"name":"schema-registry","full_name":"alexlod/schema-registry","owner":{"login":"alexlod","id":39045,"avatar_url":"https://avatars.githubusercontent.com/u/39045?v=3","gravatar_id":"","url":"https://api.github.com/users/alexlod","html_url":"https://github.com/alexlod","followers_url":"https://api.github.com/users/alexlod/followers","following_url":"https://api.github.com/users/alexlod/following{/other_user}","gists_url":"https://api.github.com/users/alexlod/gists{/gist_id}","starred_url":"https://api.github.com/users/alexlod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexlod/subscriptions","organizations_url":"https://api.github.com/users/alexlod/orgs","repos_url":"https://api.github.com/users/alexlod/repos","events_url":"https://api.github.com/users/alexlod/events{/privacy}","received_events_url":"https://api.github.com/users/alexlod/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/alexlod/schema-registry","description":"Schema registry for Kafka","fork":true,"url":"https://api.github.com/repos/alexlod/schema-registry","forks_url":"https://api.github.com/repos/alexlod/schema-registry/forks","keys_url":"https://api.github.com/repos/alexlod/schema-registry/keys{/key_id}","collaborators_url":"https://api.github.com/repos/alexlod/schema-registry/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/alexlod/schema-registry/teams","hooks_url":"https://api.github.com/repos/alexlod/schema-registry/hooks","issue_events_url":"https://api.github.com/repos/alexlod/schema-registry/issues/events{/number}","events_url":"https://api.github.com/repos/alexlod/schema-registry/events","assignees_url":"https://api.github.com/repos/alexlod/schema-registry/assignees{/user}","branches_url":"https://api.github.com/repos/alexlod/schema-registry/branches{/branch}","tags_url":"https://api.github.com/repos/alexlod/schema-registry/tags","blobs_url":"https://api.github.com/repos/alexlod/schema-registry/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/alexlod/schema-registry/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/alexlod/schema-registry/git/refs{/sha}","trees_url":"https://api.github.com/repos/alexlod/schema-registry/git/trees{/sha}","statuses_url":"https://api.github.com/repos/alexlod/schema-registry/statuses/{sha}","languages_url":"https://api.github.com/repos/alexlod/schema-registry/languages","stargazers_url":"https://api.github.com/repos/alexlod/schema-registry/stargazers","contributors_url":"https://api.github.com/repos/alexlod/schema-registry/contributors","subscribers_url":"https://api.github.com/repos/alexlod/schema-registry/subscribers","subscription_url":"https://api.github.com/repos/alexlod/schema-registry/subscription","commits_url":"https://api.github.com/repos/alexlod/schema-registry/commits{/sha}","git_commits_url":"https://api.github.com/repos/alexlod/schema-registry/git/commits{/sha}","comments_url":"https://api.github.com/repos/alexlod/schema-registry/comments{/number}","issue_comment_url":"https://api.github.com/repos/alexlod/schema-registry/issues/comments{/number}","contents_url":"https://api.github.com/repos/alexlod/schema-registry/contents/{+path}","compare_url":"https://api.github.com/repos/alexlod/schema-registry/compare/{base}...{head}","merges_url":"https://api.github.com/repos/alexlod/schema-registry/merges","archive_url":"https://api.github.com/repos/alexlod/schema-registry/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/alexlod/schema-registry/downloads","issues_url":"https://api.github.com/repos/alexlod/schema-registry/issues{/number}","pulls_url":"https://api.github.com/repos/alexlod/schema-registry/pulls{/number}","milestones_url":"https://api.github.com/repos/alexlod/schema-registry/milestones{/number}","notifications_url":"https://api.github.com/repos/alexlod/schema-registry/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/alexlod/schema-registry/labels{/name}","releases_url":"https://api.github.com/repos/alexlod/schema-registry/releases{/id}","deployments_url":"https://api.github.com/repos/alexlod/schema-registry/deployments","created_at":"2015-12-15T21:46:49Z","updated_at":"2015-12-15T21:46:50Z","pushed_at":"2016-06-09T17:14:20Z","git_url":"git://github.com/alexlod/schema-registry.git","ssh_url":"git@github.com:alexlod/schema-registry.git","clone_url":"https://github.com/alexlod/schema-registry.git","svn_url":"https://github.com/alexlod/schema-registry","homepage":null,"size":1290,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"confluentinc:3.x","ref":"3.x","sha":"a64f0dec88de6fab386677e75300d9ce2216eb0b","user":{"login":"confluentinc","id":9439498,"avatar_url":"https://avatars.githubusercontent.com/u/9439498?v=3","gravatar_id":"","url":"https://api.github.com/users/confluentinc","html_url":"https://github.com/confluentinc","followers_url":"https://api.github.com/users/confluentinc/followers","following_url":"https://api.github.com/users/confluentinc/following{/other_user}","gists_url":"https://api.github.com/users/confluentinc/gists{/gist_id}","starred_url":"https://api.github.com/users/confluentinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/confluentinc/subscriptions","organizations_url":"https://api.github.com/users/confluentinc/orgs","repos_url":"https://api.github.com/users/confluentinc/repos","events_url":"https://api.github.com/users/confluentinc/events{/privacy}","received_events_url":"https://api.github.com/users/confluentinc/received_events","type":"Organization","site_admin":false},"repo":{"id":27790789,"name":"schema-registry","full_name":"confluentinc/schema-registry","owner":{"login":"confluentinc","id":9439498,"avatar_url":"https://avatars.githubusercontent.com/u/9439498?v=3","gravatar_id":"","url":"https://api.github.com/users/confluentinc","html_url":"https://github.com/confluentinc","followers_url":"https://api.github.com/users/confluentinc/followers","following_url":"https://api.github.com/users/confluentinc/following{/other_user}","gists_url":"https://api.github.com/users/confluentinc/gists{/gist_id}","starred_url":"https://api.github.com/users/confluentinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/confluentinc/subscriptions","organizations_url":"https://api.github.com/users/confluentinc/orgs","repos_url":"https://api.github.com/users/confluentinc/repos","events_url":"https://api.github.com/users/confluentinc/events{/privacy}","received_events_url":"https://api.github.com/users/confluentinc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/confluentinc/schema-registry","description":"Schema registry for Kafka","fork":false,"url":"https://api.github.com/repos/confluentinc/schema-registry","forks_url":"https://api.github.com/repos/confluentinc/schema-registry/forks","keys_url":"https://api.github.com/repos/confluentinc/schema-registry/keys{/key_id}","collaborators_url":"https://api.github.com/repos/confluentinc/schema-registry/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/confluentinc/schema-registry/teams","hooks_url":"https://api.github.com/repos/confluentinc/schema-registry/hooks","issue_events_url":"https://api.github.com/repos/confluentinc/schema-registry/issues/events{/number}","events_url":"https://api.github.com/repos/confluentinc/schema-registry/events","assignees_url":"https://api.github.com/repos/confluentinc/schema-registry/assignees{/user}","branches_url":"https://api.github.com/repos/confluentinc/schema-registry/branches{/branch}","tags_url":"https://api.github.com/repos/confluentinc/schema-registry/tags","blobs_url":"https://api.github.com/repos/confluentinc/schema-registry/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/confluentinc/schema-registry/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/confluentinc/schema-registry/git/refs{/sha}","trees_url":"https://api.github.com/repos/confluentinc/schema-registry/git/trees{/sha}","statuses_url":"https://api.github.com/repos/confluentinc/schema-registry/statuses/{sha}","languages_url":"https://api.github.com/repos/confluentinc/schema-registry/languages","stargazers_url":"https://api.github.com/repos/confluentinc/schema-registry/stargazers","contributors_url":"https://api.github.com/repos/confluentinc/schema-registry/contributors","subscribers_url":"https://api.github.com/repos/confluentinc/schema-registry/subscribers","subscription_url":"https://api.github.com/repos/confluentinc/schema-registry/subscription","commits_url":"https://api.github.com/repos/confluentinc/schema-registry/commits{/sha}","git_commits_url":"https://api.github.com/repos/confluentinc/schema-registry/git/commits{/sha}","comments_url":"https://api.github.com/repos/confluentinc/schema-registry/comments{/number}","issue_comment_url":"https://api.github.com/repos/confluentinc/schema-registry/issues/comments{/number}","contents_url":"https://api.github.com/repos/confluentinc/schema-registry/contents/{+path}","compare_url":"https://api.github.com/repos/confluentinc/schema-registry/compare/{base}...{head}","merges_url":"https://api.github.com/repos/confluentinc/schema-registry/merges","archive_url":"https://api.github.com/repos/confluentinc/schema-registry/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/confluentinc/schema-registry/downloads","issues_url":"https://api.github.com/repos/confluentinc/schema-registry/issues{/number}","pulls_url":"https://api.github.com/repos/confluentinc/schema-registry/pulls{/number}","milestones_url":"https://api.github.com/repos/confluentinc/schema-registry/milestones{/number}","notifications_url":"https://api.github.com/repos/confluentinc/schema-registry/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/confluentinc/schema-registry/labels{/name}","releases_url":"https://api.github.com/repos/confluentinc/schema-registry/releases{/id}","deployments_url":"https://api.github.com/repos/confluentinc/schema-registry/deployments","created_at":"2014-12-09T22:38:11Z","updated_at":"2016-06-08T16:28:37Z","pushed_at":"2016-06-09T17:14:21Z","git_url":"git://github.com/confluentinc/schema-registry.git","ssh_url":"git@github.com:confluentinc/schema-registry.git","clone_url":"https://github.com/confluentinc/schema-registry.git","svn_url":"https://github.com/confluentinc/schema-registry","homepage":null,"size":1743,"stargazers_count":206,"watchers_count":206,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":130,"mirror_url":null,"open_issues_count":88,"forks":130,"open_issues":88,"watchers":206,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344"},"html":{"href":"https://github.com/confluentinc/schema-registry/pull/344"},"issue":{"href":"https://api.github.com/repos/confluentinc/schema-registry/issues/344"},"comments":{"href":"https://api.github.com/repos/confluentinc/schema-registry/issues/344/comments"},"review_comments":{"href":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344/comments"},"review_comment":{"href":"https://api.github.com/repos/confluentinc/schema-registry/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/confluentinc/schema-registry/pulls/344/commits"},"statuses":{"href":"https://api.github.com/repos/confluentinc/schema-registry/statuses/3daa4bc539097950e66104eae1c152ab82324b3b"}}}}
{"actor":{"display_login":"alexlod"}}