ERROR: Sasl Scram-sha-512 configuration

[emimifleur]

I need help getting past this issue please.
I am currently working on setting up SASL configuration for Kafka. I am utilizing the Strimzi Kafka Operator along with a custom Kafka config deployed via a Helm chart. Although the pods appear to be healthy, I am encountering errors in the two broker pods:

Error 1:

INFO [Socket Server listenerType=ZK_BROKER, (channelId=xx.xxx.x.xx:9092-xx.xxx.x.x:5xxxxx-9xxxx)
(Unexpected Kafka request of type FIND_COORDINATOR (org.apache.kafka.common.network.Selector)
[data-plane-kafka-network-thread-0-ListenerName (PLAIN-9092)-SASL_PLAINTEXT-5]
This error message indicates a failed authentication during the SASL handshake with the IP address /10.xxx.x.x.

Error 2:

Failing SASL authentication due to invalid receive size (org.apache.kafka.common.network.Selector)
[data-plane-kafka-network-thread-8-ListenerName (PLAIN-9892)-SASL_PLAINTEXT-5]
This error suggests that the SASL authentication is failing due to an invalid receive size.

Additionally, I am receiving a warning from the Kafka-UI, stating:

Connection WARN [0:39m [[34mkafka-admin-client-thread | kafka-ui-admin-client-xxx 
[mo.a.k.c.NetworkClient [0:39m: [AdminClient clientId-kafka-ui-admin-client-xxx]
to node cluster-kafka-bootstrap.kafka-operator.svc/10.xx.x.xx:9092) terminated during authentication.
This may happen for the following reasons: (1) Authentication failed due to invalid credentials with brokers older than 1.0.0,
(2) Firewall blocking TLS traffic (e.g., allowing only HTTPS traffic), (3) Transient...

Here is what the kafka configuration look like:

spec:
  kafka:
    version: {{ .cluster.version }}
    replicas: {{ len .cluster.brokerIpAddresses }}
    image: {{ .image }}
    rack:
      {{- if .cluster.topologyKey }}
      topologyKey: {{ .cluster.topologyKey }}
      {{- end}}
    authorization:
      type: simple
      superUsers:
        - CN=my-name-user
        - CN=cd-user
        - CN=stry-user
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
        authentication:
          type: scram-sha-512
      - name: external
        port: 9895
        type: loadbalancer
        tls: false
...
    config:
...
      inter.broker.listener.name: SASL_SSL
      security.inter.broker.listener.name: SASL_SSL
      sasl.enabled.mechanisms: SCRAM-SHA-512
      sasl.mechanism.inter.broker.protocol: SCRAM-SHA-512
      authorizer.class.name: kafka.security.auth.AclAuthorizer

The kafka-ui config :

      containers:
        - name: {{ .Chart.Name }}
          env:
            ...
            - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
              value: SASL_SSL
            - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM
             value: SCRAM-SHA-512
            - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
             value: org.apache.kafka.common.security.scram.ScramLoginModule required username="my-name-user" password="user-secret";

[scholzj]

You have tls: false in the listener configuration. So your KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL should ba SASL_PLAINTEXT and not SASL_SSL I guess.

[emimifleur]

Thank you so much for getting back to me.
I forgot to add that I already set
security_inter_broker_protocol = SASL_SSL in the kafka config block.

updating KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL and security_inter_broker_protocol to sasl_plaintext and it returned the same errors for the kafka broker logs. For the kafka-ui, the first error is no longer present. So, using SASL_PLAINTEXT resolved it, thank you.

However, in the kafka-ui, it is now showing that the kafka-ui is not communicating with the cluster. When I remove the SASL parameters, it comes back to normal. Not sure what could be the issue here?

severity: "INFO"
textPayload:
[30m2023-05-14 03:01:03,713 [0:39m [1;31mERROR [0;39m [ [34mparallel-1 [0:39m] [33mc.p.k.u.s.StatisticsService [0:39m: Failed to collect cluster my-cluster-0 info"

java.lang.IllegalStateException: Error while creating AdminClient for Cluster mycluster-0 at
com.provectus.kafka.ui.service.AdminClient Servicelmpl.lambda$createAdminClient$3(AdminClient Servicelmpl.java:45) at
reactor.core.publisher.Mono.lambda$onErrorMap$31(Mono.java:3776) at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:94) at
reactor.core.publisher.FluxHide$$uppressFuseableSubscriber.onError(FluxHide.java:142) at reactor.core.publisher.FluxMap$MapSubscriber.onError(FluxMap.java:134) at
reactor.core.publisher.Operators $MultiSubscriptionSubscriber.onError(Operators.java:2063) at reactor.core.publisher.MonoFlat Map$FlatMapMain.onError(MonoFlatMap.java:172)
reactor.core.publisher.MonoFlat Map$FlatMapMain.secondError(MonoFlatMap.java:192) at reactor.core.publisher.MonoFlatMap$FlatMapinner.onError(MonoFlatMap.java:259) at
reactor.core.publisher.FluxMap$MapSubscriber.onError(FluxMap.java:134) at reactor.core.publisher.FluxOnErrorResume $Resume Subscriber.onError(FluxOnErrorResume.java:106)
reactor.core.publisher.Operators.error(Operators.java:198) at reactor.core.publisher.MonoError.subscribe (MonoError.java:53) at
reactor.core.publisher.Mono.subscribe(Mono.java:4455) at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:103)
reactor.core.publisher.MonoPeekTerminal$MonoTerminalPeekSubscriber.onError(MonoPeekTerminal.java:258) at
reactor.core.publisher.MonoPublishOn$PublishOnSubscriber.run(MonoPublishOn.java:187) at reactor.core.scheduler.Scheduler Task.call(SchedulerTask.java:68)
reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:28) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) t java.base/
java.util.concurrent.ScheduledThreadPoolExecutor$Scheduled FutureTask.run(Scheduled ThreadPoolExecutor.java:304) at java.base/
java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:833) Caused by: org.apache,kafka.common.errors. ClusterAuthorizationException: Cluster authorization failed.

[scholzj]

Thank you so much for getting back to me.
I forgot to add that I already set
security_inter_broker_protocol = SASL_SSL in the kafka config block.

I'm not sure what you mean with kafka ocnfig block. But this has nothing to do with it and is wrong.

---

If you read properly the error from the UI, you are now getting ClusterAuthorizationException: Cluster authorization failed => that means that the UI is missing some access rights. So you need to give it the right it needs, make it a super user or disable authorization (which might not be secure, but should solve the error).

[scholzj]

That is not really readable, to be honest. You would probably need to get a full log and config. But I do not know if I would be able to help with ksqldc even with that as I never used it.