Skip to content

Commit 74acb1f

Browse files
committed
Add managed identity to Kafka quickstart
1 parent 4289dd1 commit 74acb1f

File tree

1 file changed

+82
-109
lines changed

1 file changed

+82
-109
lines changed

articles/event-hubs/event-hubs-quickstart-kafka-enabled-event-hubs.md

Lines changed: 82 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: 'Quickstart: Data streaming with Azure Event Hubs using the Kafka protocol'
33
description: 'Quickstart: This article provides information on how to stream into Azure Event Hubs using the Kafka protocol and APIs.'
44
ms.topic: quickstart
5-
ms.date: 05/10/2021
5+
ms.date: 09/22/2022
66
ms.custom: mode-other
77
---
88

@@ -18,108 +18,107 @@ in your applications.
1818
To complete this quickstart, make sure you have the following prerequisites:
1919

2020
* Read through the [Event Hubs for Apache Kafka](event-hubs-for-kafka-ecosystem-overview.md) article.
21-
* An Azure subscription. If you do not have one, create a [free account](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio) before you begin.
21+
* An Azure subscription. If you don't have one, create a [free account](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio) before you begin.
2222
* [Java Development Kit (JDK) 1.7+](/azure/developer/java/fundamentals/java-support-on-azure).
2323
* [Download](https://maven.apache.org/download.cgi) and [install](https://maven.apache.org/install.html) a Maven binary archive.
2424
* [Git](https://www.git-scm.com/)
2525

2626

2727
## Create an Event Hubs namespace
28-
When you create an Event Hubs namespace, the Kafka endpoint for the namespace is automatically enabled. You can stream events from your applications that use the Kafka protocol into event hubs. Follow step-by-step instructions in the [Create an event hub using Azure portal](event-hubs-create.md) to create an Event Hubs namespace. If you are using a dedicated cluster, see [Create a namespace and event hub in a dedicated cluster](event-hubs-dedicated-cluster-create-portal.md#create-a-namespace-and-event-hub-within-a-cluster).
28+
When you create an Event Hubs namespace, the Kafka endpoint for the namespace is automatically enabled. You can stream events from your applications that use the Kafka protocol into event hubs. Follow step-by-step instructions in the [Create an event hub using Azure portal](event-hubs-create.md) to create an Event Hubs namespace. If you're using a dedicated cluster, see [Create a namespace and event hub in a dedicated cluster](event-hubs-dedicated-cluster-create-portal.md#create-a-namespace-and-event-hub-within-a-cluster).
2929

3030
> [!NOTE]
3131
> Event Hubs for Kafka isn't supported in the **basic** tier.
3232
3333
## Send and receive messages with Kafka in Event Hubs
3434

35-
1. Clone the [Azure Event Hubs for Kafka repository](https://github.com/Azure/azure-event-hubs-for-kafka).
35+
#### [Passwordless (Recommended)](#tab/passwordless)
3636

37+
1. Clone the [Azure Event Hubs for Kafka repository](https://github.com/Azure/azure-event-hubs-for-kafka).
3738
2. Navigate to `azure-event-hubs-for-kafka/quickstart/java/producer`.
38-
3939
3. Update the configuration details for the producer in `src/main/resources/producer.config` as follows:
4040

41+
Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code.
4142

42-
#### [Passwordless (Recommended)](#tab/passwordless)
43-
44-
**OAuth:**
45-
46-
Azure Event Hubs supports using Azure Active Directory (Azure AD) to authorize requests to Event Hubs resources. With Azure AD, you can use Azure role-based access control (Azure RBAC) to grant permissions to a security principal, which may be a user, or an application service principal.
47-
48-
If you want to run this sample locally with Azure AD authentication, be sure your user account has authenticated via Azure Toolkit for IntelliJ, Visual Studio Code Azure Account plugin, or Azure CLI. Also, be sure the account has been granted sufficient permissions.
49-
50-
> [!NOTE]
51-
> You need to set the following data plane access roles: `Azure Event Hubs Data Sender` and `Azure Event Hubs Data Receiver`.
52-
53-
To authenticate using the Azure CLI, use the following steps.
54-
55-
1. First, use the following command to get the resource ID for your Azure Event Hubs namespace:
56-
57-
```azurecli
58-
export AZURE_RESOURCE_ID=$(az resource show \
59-
--resource-group $AZ_RESOURCE_GROUP \
60-
--name $AZ_EVENTHUBS_NAMESPACE_NAME \
61-
--resource-type Microsoft.EventHub/Namespaces \
62-
--query "id" \
63-
--output tsv)
64-
```
65-
66-
1. Second, use the following command to get your user object ID of your Azure CLI user account:
67-
68-
```azurecli
69-
export AZURE_ACCOUNT_ID=$(az ad signed-in-user show \
70-
--query "id" --output tsv)
71-
```
43+
Azure Event Hubs supports using Azure Active Directory (Azure AD) to authorize requests to Event Hubs resources. With Azure AD, you can use Azure role-based access control (Azure RBAC) to grant permissions to a security principal, which may be a user, or an application service principal.
44+
45+
To use Managed Identity, you can create a (or configure an existing) virtual machine using a system-assigned managed identity. See [Configure managed identities for Azure resources on a VM using the Azure portal](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm#system-assigned-managed-identity) for more details.
46+
47+
Once you configure the virtual machine with managed identity, you need to add managed idendity to Event Hubs namespace. For that you need to follow these steps.
48+
49+
- In the Azure Portal, navigate to your Event Hubs namespace. Go to "Access Control (IAM)" in the left navigation.
50+
51+
- Click + Add and select `Add role assignment`.
52+
53+
- In the Role tab, select `Azure Event Hubs Data Owner` and click the Next button.
54+
55+
- In the `Members` tab, select the `Managed Identity` radio button for type to assign access to.
56+
57+
- Click the `+Select members` link. In the Managed Identity dropdown, select Virtual Machine and select your virtual machine's managed identity.
58+
59+
- Click `Review + Assign`.
7260

73-
1. Then, use the following commands to assign the `Azure Event Hubs Data Sender` and `Azure Event Hubs Data Receiver` roles to your account.
61+
1. Once you configure managed identity you can update `src/main/resources/producer.config` as shown below.
62+
63+
```xml
64+
bootstrap.servers=NAMESPACENAME.servicebus.windows.net:9093
65+
security.protocol=SASL_SSL
66+
sasl.mechanism=OAUTHBEARER
67+
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
68+
sasl.login.callback.handler.class=CustomAuthenticateCallbackHandler;
69+
```
70+
71+
You can find the source code for the sample handler class CustomAuthenticateCallbackHandler on GitHub [here](https://github.com/Azure/azure-event-hubs-for-kafka/tree/master/tutorials/oauth/java/appsecret/producer/src/main/java).
7472

75-
```azurecli
76-
az role assignment create \
77-
--assignee $AZURE_ACCOUNT_ID \
78-
--role "Azure Event Hubs Data Receiver" \
79-
--scope $AZURE_RESOURCE_ID
73+
4. Run the producer code and stream events into Event Hubs:
8074

81-
az role assignment create \
82-
--assignee $AZURE_ACCOUNT_ID \
83-
--role "Azure Event Hubs Data Sender" \
84-
--scope $AZURE_RESOURCE_ID
85-
```
86-
87-
For more information about granting access roles, see [Authorize access to Event Hubs resources using Azure Active Directory](/azure/event-hubs/authorize-access-azure-active-directory).
88-
89-
Once your user account is authenticated, you can update use following configuration in `src/main/resources/producer.config` as shown below.
75+
```shell
76+
mvn clean package
77+
mvn exec:java -Dexec.mainClass="TestProducer"
78+
```
79+
80+
5. Navigate to `azure-event-hubs-for-kafka/quickstart/java/consumer`.
9081

91-
```xml
92-
bootstrap.servers=NAMESPACENAME.servicebus.windows.net:9093
93-
security.protocol=SASL_SSL
94-
sasl.mechanism=OAUTHBEARER
95-
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
96-
sasl.login.callback.handler.class=CustomAuthenticateCallbackHandler;
97-
```
82+
6. Update the configuration details for the consumer in `src/main/resources/consumer.config` as follows:
83+
1. Make sure you configure managed identity as mentioned in step 3 and use the following consumer configuration.
9884

99-
You can find the source code for the sample handler class CustomAuthenticateCallbackHandler on GitHub [here](https://github.com/Azure/azure-event-hubs-for-kafka/tree/master/tutorials/oauth/java/appsecret/producer/src/main/java).
85+
```xml
86+
bootstrap.servers=NAMESPACENAME.servicebus.windows.net:9093
87+
security.protocol=SASL_SSL
88+
sasl.mechanism=OAUTHBEARER
89+
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
90+
sasl.login.callback.handler.class=CustomAuthenticateCallbackHandler;
91+
```
92+
93+
You can find the source code for the sample handler class CustomAuthenticateCallbackHandler on GitHub [here](https://github.com/Azure/azure-event-hubs-for-kafka/tree/master/tutorials/oauth/java/appsecret/consumer/src/main/java).
94+
95+
You can find all the OAuth samples for Event Hubs for Kafka [here](https://github.com/Azure/azure-event-hubs-for-kafka/tree/master/tutorials/oauth).
96+
7. Run the consumer code and process events from event hub using your Kafka clients:
10097

98+
```java
99+
mvn clean package
100+
mvn exec:java -Dexec.mainClass="TestConsumer"
101+
```
101102

102-
---
103+
If your Event Hubs Kafka cluster has events, you now start receiving them from the consumer.
103104

104105
#### [Connection string](#tab/connection-string)
105106

106-
**TLS/SSL:**
107+
1. Clone the [Azure Event Hubs for Kafka repository](https://github.com/Azure/azure-event-hubs-for-kafka).
108+
2. Navigate to `azure-event-hubs-for-kafka/quickstart/java/producer`.
109+
3. Update the configuration details for the producer in `src/main/resources/producer.config` as follows:
107110

111+
108112
```xml
109113
bootstrap.servers=NAMESPACENAME.servicebus.windows.net:9093
110114
security.protocol=SASL_SSL
111115
sasl.mechanism=PLAIN
112116
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="{YOUR.EVENTHUBS.CONNECTION.STRING}";
113117
```
114-
115-
> [!IMPORTANT]
116-
> Replace `{YOUR.EVENTHUBS.CONNECTION.STRING}` with the connection string for your Event Hubs namespace. For instructions on getting the connection string, see [Get an Event Hubs connection string](event-hubs-get-connection-string.md). Here's an example configuration: `sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="Endpoint=sb://mynamespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=XXXXXXXXXXXXXXXX";`
117-
118-
---
119-
120-
121-
122-
118+
119+
> [!IMPORTANT]
120+
> Replace `{YOUR.EVENTHUBS.CONNECTION.STRING}` with the connection string for your Event Hubs namespace. For instructions on getting the connection string, see [Get an Event Hubs connection string](event-hubs-get-connection-string.md). Here's an example configuration: `sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="Endpoint=sb://mynamespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=XXXXXXXXXXXXXXXX";`
121+
123122
4. Run the producer code and stream events into Event Hubs:
124123

125124
```shell
@@ -130,46 +129,16 @@ You can find the source code for the sample handler class CustomAuthenticateCall
130129
5. Navigate to `azure-event-hubs-for-kafka/quickstart/java/consumer`.
131130

132131
6. Update the configuration details for the consumer in `src/main/resources/consumer.config` as follows:
133-
134-
135-
#### [Passwordless (Recommended)](#tab/passwordless)
136-
137-
Make sure you configure Azure AD authentication as mentioned in step 3 and use the followning consumer configuration.
138-
**OAuth:**
139-
140-
```xml
141-
bootstrap.servers=NAMESPACENAME.servicebus.windows.net:9093
142-
security.protocol=SASL_SSL
143-
sasl.mechanism=OAUTHBEARER
144-
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required;
145-
sasl.login.callback.handler.class=CustomAuthenticateCallbackHandler;
146-
```
147-
148-
You can find the source code for the sample handler class CustomAuthenticateCallbackHandler on GitHub [here](https://github.com/Azure/azure-event-hubs-for-kafka/tree/master/tutorials/oauth/java/appsecret/consumer/src/main/java).
149-
150-
You can find all the OAuth samples for Event Hubs for Kafka [here](https://github.com/Azure/azure-event-hubs-for-kafka/tree/master/tutorials/oauth).
151-
152-
153-
---
154-
155-
#### [Connection string](#tab/connection-string)
156-
157-
**TLS/SSL:**
158-
159-
```xml
160-
bootstrap.servers=NAMESPACENAME.servicebus.windows.net:9093
161-
security.protocol=SASL_SSL
162-
sasl.mechanism=PLAIN
163-
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="{YOUR.EVENTHUBS.CONNECTION.STRING}";
164-
```
165-
166-
> [!IMPORTANT]
167-
> Replace `{YOUR.EVENTHUBS.CONNECTION.STRING}` with the connection string for your Event Hubs namespace. For instructions on getting the connection string, see [Get an Event Hubs connection string](event-hubs-get-connection-string.md). Here's an example configuration: `sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="Endpoint=sb://mynamespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=XXXXXXXXXXXXXXXX";`
168-
169-
---
170-
171-
172-
132+
133+
```xml
134+
bootstrap.servers=NAMESPACENAME.servicebus.windows.net:9093
135+
security.protocol=SASL_SSL
136+
sasl.mechanism=PLAIN
137+
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="{YOUR.EVENTHUBS.CONNECTION.STRING}";
138+
```
139+
140+
> [!IMPORTANT]
141+
> Replace `{YOUR.EVENTHUBS.CONNECTION.STRING}` with the connection string for your Event Hubs namespace. For instructions on getting the connection string, see [Get an Event Hubs connection string](event-hubs-get-connection-string.md). Here's an example configuration: `sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="Endpoint=sb://mynamespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=XXXXXXXXXXXXXXXX";`
173142

174143
7. Run the consumer code and process events from event hub using your Kafka clients:
175144

@@ -180,5 +149,9 @@ sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule require
180149

181150
If your Event Hubs Kafka cluster has events, you now start receiving them from the consumer.
182151

152+
---
153+
154+
155+
183156
## Next steps
184157
In this article, you learned how to stream into Event Hubs without changing your protocol clients or running your own clusters. To learn more, see [Apache Kafka developer guide for Azure Event Hubs](apache-kafka-developer-guide.md).

0 commit comments

Comments
 (0)