Question : Kafka Event Listener and SASL_SSL/SCRAM auth client config

[fromcloudbase]

I try to configure kafka-event-listener with SASL_SSL and SCRAM auth and get the following error

Caused by: java.lang.IllegalArgumentException: Chunk [sasl.jaas.config="org.apache.kafka.common.security.scram.ScramLoginModule required username="xxxxxxx" password="yyyyyy";"] is not a valid entry

A quick dive in plugin's code makes me think this AuthN method is not yet supported.
Neither can I find anything in plugin's doc on that topic (kafka-event-listener.client-config-overrides is poorly documented).
Any info on that matter will be appreciated.

[hashhar]

Not supported for now.

[hashhar]

Actually I'm not sure.

The overrides passes properties as is to KafkaClient.

You don't share how you configured it so it's hard to say anyway.

[fromcloudbase]

Hi @hashhar
Thanks for your help.
Configuration :

# Kafka event listener config
event-listener.name=kafka
# Kafka clientId
kafka-event-listener.client-id=trino_cluster
kafka-event-listener.broker-endpoints=broker0:9092,broker0:9092,broker0:9092
# Name of the Kafka topic for the query creation event data
kafka-event-listener.created-event.topic=trino-events
# Name of the Kafka topic for the query completion event data
kafka-event-listener.completed-event.topic=trino-events
# When set, Kafka events are sent with additional metadata populated from environment variables. 
# For example, if the value is TRINO_INSIGHTS_ and an environment variable on the cluster is set at 
# TRINO_INSIGHTS_CLUSTER_ID=foo, then the Kafka payload metadata contains CLUSTER_ID=foo.
kafka-event-listener.env-var-prefix=TRINO_INSIGHTS_
kafka-event-listener.client-config-overrides=ssl.keystore.location=etc/tls/external-keystore.jks,ssl.keystore.password=xxx,ssl.key.password=xxx,ssl.keystore.type=JKS,ssl.truststore.location=etc/tls/external-truststore.jks,ssl.truststore.password=yyyy,ssl.truststore.type=JKS,security.protocol=SASL_SSL,sasl.mechanism=SCRAM-SHA-512,sasl.jaas.config="org.apache.kafka.common.security.scram.ScramLoginModule required username='trino_eventlistener' password='zzzzzz';"

Error returned

I've tried many variations for sasl.jaas.config value (with or without "").

[hashhar]

cc: @sopel39 @marton-bod any ideas?

Might have been easier to have use separate file instead of inline config.

[sharas2050]

I tried by putting JAAS config under env variable but it is still not valid:

kafka-event-listener.client-config-overrides=security.protocol=SASL_SSL,sasl.mechanism=SCRAM-SHA-256,${ENV:TRINO_KAFKA_JAAS_CONFIG}

would be nice to have same options as we have under regular connector to override configs with a file and support jaas.config as we have here: https://github.com/trinodb/trino/blob/master/plugin/trino-kafka/src/main/java/io/trino/plugin/kafka/KafkaConfig.java#L161