[jira] [Updated] (KAFKA-17636) The StorageTool does not write SCRAM credentials when formatting disk

["Federico Valeri (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KAFKA-17636?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Federico Valeri updated KAFKA-17636:
------------------------------------
    Summary: The StorageTool does not write SCRAM credentials when formatting disk  (was: StorageTool does not write SCRAM credentials when formatting disk)

> The StorageTool does not write SCRAM credentials when formatting disk
> ---------------------------------------------------------------------
>
>                 Key: KAFKA-17636
>                 URL: https://issues.apache.org/jira/browse/KAFKA-17636
>             Project: Kafka
>          Issue Type: Bug
>    Affects Versions: 3.9.0
>            Reporter: Federico Valeri
>            Priority: Blocker
>
> When initializing a KRaft cluster with SCRAM inter-broker authentication, you have to create user credentials using the StorageTool before starting the brokers:
> {code:java}
> bin/kafka-storage.sh format -c /opt/kafka/server3/config/server.properties" -t a2FdMvicQUmCYojQZnNsIw \
>     -S "SCRAM-SHA-512=[name=admin,password=changeit]"
> {code}
> This command should produce a similar metadata record in the metadata log (this is taken from 3.8.0):
> {code:java}
> | offset: 3 CreateTime: 1727435366178 keySize: -1 valueSize: 171 sequence: -1 headerKeys: [] payload: {"type":"USER_SCRAM_CREDENTIAL_RECORD","version":0,"data":{"name":"admin","mechanism":2,"salt":"bmNvZHNpNm1yaWdzbTcycndlcWJtdnltag==","storedKey":"00pZjSfcztrhNNgbP7VDwb22L+s8ySG+NfkF5+5AiytOdD/9gm2L7xxLkPO54lpF/sAD0mwcIm3rGWKqiIWdkg==","serverKey":"kQL0eg4cauRtKIhUf5zXK/3lLJe7TMRwcybUja7J49t3NJ5aM/o7lVm7RNbsxzhKxYqEAmRX6wjMkD8T7H6rxw==","iterations":4096}}
> {code}
> Then, at start time, the brokers would load these user credentials and authenticate against each other, or clients presenting the same credentials.
> It looks like this metadata record is not written anymore by the tool, so the authentication fails with invalid credentials because the user credentials cache is empty.
> AFAICS, the issue was introduced here: [https://github.com/apache/kafka/commit/02f541d4ea51ee9034f92d249dde96bc70860e5e].



--
This message was sent by Atlassian Jira
(v8.20.10#820010)