Skip to content

Commit 124a2c3

Browse files
faecfaec
authored
Move Kerberos FAST config flag to shared kerberos config (#26141)
1 parent 0829211 commit 124a2c3

22 files changed

Lines changed: 87 additions & 63 deletions

‎auditbeat/auditbeat.reference.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,7 @@ output.elasticsearch:
594594
# Kerberos realm.
595595
#kerberos.realm: ELASTIC
596596

597+
597598
# ------------------------------ Logstash Output -------------------------------
598599
#output.logstash:
599600
# Boolean flag to enable or disable the output module.
@@ -852,10 +853,6 @@ output.elasticsearch:
852853
# purposes. The default is "beats".
853854
#client_id: beats
854855

855-
# Enables Kerberos FAST authentication in the Kafka output. This may
856-
# conflict with certain Active Directory configurations.
857-
#enable_krb5_fast: false
858-
859856
# Use SSL settings for HTTPS.
860857
#ssl.enabled: true
861858

@@ -934,6 +931,10 @@ output.elasticsearch:
934931
# Kerberos realm.
935932
#kerberos.realm: ELASTIC
936933

934+
# Enables Kerberos FAST authentication. This may
935+
# conflict with certain Active Directory configurations.
936+
#kerberos.enable_krb5_fast: false
937+
937938
# -------------------------------- Redis Output --------------------------------
938939
#output.redis:
939940
# Boolean flag to enable or disable the output module.

‎filebeat/filebeat.reference.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1497,6 +1497,7 @@ output.elasticsearch:
14971497
# Kerberos realm.
14981498
#kerberos.realm: ELASTIC
14991499

1500+
15001501
# ------------------------------ Logstash Output -------------------------------
15011502
#output.logstash:
15021503
# Boolean flag to enable or disable the output module.
@@ -1755,10 +1756,6 @@ output.elasticsearch:
17551756
# purposes. The default is "beats".
17561757
#client_id: beats
17571758

1758-
# Enables Kerberos FAST authentication in the Kafka output. This may
1759-
# conflict with certain Active Directory configurations.
1760-
#enable_krb5_fast: false
1761-
17621759
# Use SSL settings for HTTPS.
17631760
#ssl.enabled: true
17641761

@@ -1837,6 +1834,10 @@ output.elasticsearch:
18371834
# Kerberos realm.
18381835
#kerberos.realm: ELASTIC
18391836

1837+
# Enables Kerberos FAST authentication. This may
1838+
# conflict with certain Active Directory configurations.
1839+
#kerberos.enable_krb5_fast: false
1840+
18401841
# -------------------------------- Redis Output --------------------------------
18411842
#output.redis:
18421843
# Boolean flag to enable or disable the output module.

‎filebeat/input/kafka/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,7 @@ func newSaramaConfig(config kafkaInputConfig) (*sarama.Config, error) {
193193
Username: config.Kerberos.Username,
194194
Password: config.Kerberos.Password,
195195
Realm: config.Kerberos.Realm,
196+
DisablePAFXFAST: !config.Kerberos.EnableFAST,
196197
}
197198
}
198199

‎heartbeat/heartbeat.reference.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -772,6 +772,7 @@ output.elasticsearch:
772772
# Kerberos realm.
773773
#kerberos.realm: ELASTIC
774774

775+
775776
# ------------------------------ Logstash Output -------------------------------
776777
#output.logstash:
777778
# Boolean flag to enable or disable the output module.
@@ -1030,10 +1031,6 @@ output.elasticsearch:
10301031
# purposes. The default is "beats".
10311032
#client_id: beats
10321033

1033-
# Enables Kerberos FAST authentication in the Kafka output. This may
1034-
# conflict with certain Active Directory configurations.
1035-
#enable_krb5_fast: false
1036-
10371034
# Use SSL settings for HTTPS.
10381035
#ssl.enabled: true
10391036

@@ -1112,6 +1109,10 @@ output.elasticsearch:
11121109
# Kerberos realm.
11131110
#kerberos.realm: ELASTIC
11141111

1112+
# Enables Kerberos FAST authentication. This may
1113+
# conflict with certain Active Directory configurations.
1114+
#kerberos.enable_krb5_fast: false
1115+
11151116
# -------------------------------- Redis Output --------------------------------
11161117
#output.redis:
11171118
# Boolean flag to enable or disable the output module.

‎journalbeat/journalbeat.reference.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,7 @@ output.elasticsearch:
537537
# Kerberos realm.
538538
#kerberos.realm: ELASTIC
539539

540+
540541
# ------------------------------ Logstash Output -------------------------------
541542
#output.logstash:
542543
# Boolean flag to enable or disable the output module.
@@ -795,10 +796,6 @@ output.elasticsearch:
795796
# purposes. The default is "beats".
796797
#client_id: beats
797798

798-
# Enables Kerberos FAST authentication in the Kafka output. This may
799-
# conflict with certain Active Directory configurations.
800-
#enable_krb5_fast: false
801-
802799
# Use SSL settings for HTTPS.
803800
#ssl.enabled: true
804801

@@ -877,6 +874,10 @@ output.elasticsearch:
877874
# Kerberos realm.
878875
#kerberos.realm: ELASTIC
879876

877+
# Enables Kerberos FAST authentication. This may
878+
# conflict with certain Active Directory configurations.
879+
#kerberos.enable_krb5_fast: false
880+
880881
# -------------------------------- Redis Output --------------------------------
881882
#output.redis:
882883
# Boolean flag to enable or disable the output module.

‎libbeat/_meta/config/output-elasticsearch.reference.yml.tmpl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,3 +98,4 @@ output.elasticsearch:
9898

9999
# Kerberos realm.
100100
#kerberos.realm: ELASTIC
101+

‎libbeat/_meta/config/output-kafka.reference.yml.tmpl‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -131,10 +131,6 @@
131131
# purposes. The default is "beats".
132132
#client_id: beats
133133

134-
# Enables Kerberos FAST authentication in the Kafka output. This may
135-
# conflict with certain Active Directory configurations.
136-
#enable_krb5_fast: false
137-
138134
{{include "ssl.reference.yml.tmpl" . | indent 2 }}
139135
# Enable Kerberos support. Kerberos is automatically enabled if any Kerberos setting is set.
140136
#kerberos.enabled: true
@@ -160,3 +156,7 @@
160156

161157
# Kerberos realm.
162158
#kerberos.realm: ELASTIC
159+
160+
# Enables Kerberos FAST authentication. This may
161+
# conflict with certain Active Directory configurations.
162+
#kerberos.enable_krb5_fast: false

‎libbeat/common/transport/kerberos/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ type Config struct {
5050
Username string `config:"username"`
5151
Password string `config:"password"`
5252
Realm string `config:"realm" validate:"required"`
53+
EnableFAST bool `config:"enable_krb5_fast"`
5354
}
5455

5556
// IsEnabled returns true if the `enable` field is set to true in the yaml.

‎libbeat/docs/shared-kerberos-config.asciidoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,8 @@ This option can only be configured for Kafka. It is the name of the Kafka servic
8686
==== `realm`
8787

8888
Name of the realm where the output resides.
89+
90+
[float]
91+
==== `enable_krb5_fast`
92+
93+
Enable Kerberos FAST authentication. This may conflict with some Active Directory installations. The default is `false`.

‎libbeat/outputs/kafka/config.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,13 @@ func newSaramaConfig(log *logp.Logger, config *kafkaConfig) (*sarama.Config, err
201201
case config.Kerberos.IsEnabled():
202202
cfgwarn.Beta("Kerberos authentication for Kafka is beta.")
203203

204+
// Due to a regrettable past decision, the flag controlling Kerberos
205+
// FAST authentication was initially added to the output configuration
206+
// rather than the shared Kerberos configuration. To avoid a breaking
207+
// change, we still check for the old flag, but it is deprecated and
208+
// should be removed in a future version.
209+
enableFAST := config.Kerberos.EnableFAST || config.EnableFAST
210+
204211
k.Net.SASL.Enable = true
205212
k.Net.SASL.Mechanism = sarama.SASLTypeGSSAPI
206213
k.Net.SASL.GSSAPI = sarama.GSSAPIConfig{
@@ -211,7 +218,7 @@ func newSaramaConfig(log *logp.Logger, config *kafkaConfig) (*sarama.Config, err
211218
Username: config.Kerberos.Username,
212219
Password: config.Kerberos.Password,
213220
Realm: config.Kerberos.Realm,
214-
DisablePAFXFAST: !config.EnableFAST,
221+
DisablePAFXFAST: !enableFAST,
215222
}
216223

217224
case config.Username != "":

0 commit comments

Comments
 (0)