CODEWITHSUNDEEP
authenticationapache-kafkakerberosjaas
learner
learner

Reputation: 1982

Transiently kerberos authentication failure with Kafka client application

I am using latest version of kafka and facing issue transiently in connecting my consumer/producer (console) clients to kafka broker over SASL_PLAINTEXT.

This is my jaas configuration file

KafkaClient {
   com.sun.security.auth.module.Krb5LoginModule required
   useTicketCache=true;
};

here are the java properties I am passing:

-Djavax.security.auth.useSubjectCredsOnly=false
-Dsecurity.protocol=SASL_PLAINTEXT
-Dsasl.kerberos.service.name=HTTP
-Dsasl.mechanism=GSSAPI

And this is the exception I am getting:

Caused by: org.apache.kafka.common.KafkaException: javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner  authentication information from the user
        at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:127)
        at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:140)
        at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:65)
        at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:88)
        at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:710)
        ... 33 more
Caused by: javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner  authentication information from the user
        at com.sun.security.auth.module.Krb5LoginModule.promptForPass(Krb5LoginModule.java:940)

Can somebody please help here.

Upvotes: 1

Views: 12299

Answers (2)

Pubudu Sitinamaluwa
Pubudu Sitinamaluwa

Reputation: 978

I would like to suggest your few options,

  1. List all the principles in currently cashed keytab and check if they are correct.

  2. If you are trying to do any change to a topic using any principle other than KAFKA, that operation will fail. Set -Dsasl.kerberos.service.name=kafka

  3. Try setting

    export KAFKA_OPTS="-Djava.security.auth.login.config=/path/to/jaas.conf -Djava.security.krb5.conf=/etc/krb5.conf -Dsun.security.krb5.debug=true"

  4. If you are using console producer/consumer, you need to provide producer configuration/consumer configuration. Configure the following properties in producer.properties or consumer.properties.

    security.protocol=SASL_PLAINTEXT (or SASL_SSL) sasl.mechanism=GSSAPI (or PLAIN)

    use command as follow for console consumer

    kafka-console-consumer --bootstrap-server host:9092 --consumer.config /path/to/consumer.properties --topic Topic

Hope this would help :)

Upvotes: 0

Gery
Gery

Reputation: 649

principal and keytab are missing in your jaas file.

see https://kafka.apache.org/documentation/#security_sasl_kerberos

Upvotes: 0

Related Questions