You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "t00011666 (via GitHub)" <gi...@apache.org> on 2026/04/27 12:19:20 UTC
[I] Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP. [skywalking]
t00011666 opened a new issue, #13849:
URL: https://github.com/apache/skywalking/issues/13849
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/skywalking/issues?q=is%3Aissue) and found no similar issues.
### Apache SkyWalking Component
OAP server (apache/skywalking)
### What happened
\n \"index\": 0,\n \"description\": \"```\\nat java.base/java.lang.Thread.run(Unknown Source)\\n\\njava.io.IOException: Channel could not be created for socket java.nio.channels.SocketChannel[closed]\\n at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:239)\\n at org.apache.kafka.common.network.Selector.connect(Selector.java:256)\\n at org.apache.kafka.common.network.Selector.init(Selector.java:992)\\n at org.apache.kafka.clients.NetworkClient.<init>(NetworkClient.java:301)\\n at org.apache.kafka.clients.admin.KafkaAdminClient.<init>(KafkaAdminClient.java:1141)\\n at org.apache.kafka.clients.admin.KafkaAdminClient.<init>(KafkaAdminClient.java:1401)\\n at java.base/java.lang.Thread.run(Unknown Source)\\nCaused by: org.apache.kafka.common.KafkaException: Failed to configure SaslClientAuthenticator\\n at org.apache.kafka.common.errors.SaslAuthenticationException: Failed to configure SaslC
lientAuthenticator\\n at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:338)\\n ... 8 more\\nCaused by: java.lang.UnsupportedOperationException: SubSubject is not supported\\n at java.base/java.lang.Subject.getSubject(Unknown Source)\\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.<init>(SaslClientAuthenticatorImpl.java:140)\\n at java.security.sasl/com.sun.security.sasl.ClientFactoryImpl.createSaslClient(Unknown Source)\\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.lambda$createSaslClient$0(SaslClientAuthenticator.java:219)\\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.withoutAuthenticator(Unknown Source)\\n at java.base/jdk.internal.vm.Scope$ScopeValueContainer.call(Unknown Source)\\n at java.base/jdk.internal.vm.Scope.withScope(Unknown Source)\\n at java.base/javax.security.auth.Subject.calls(Unknown Source)\\n
### What you expected to happen
It is possible to start pulling metrics and trace data from Kafak normally.
### How to reproduce
The skywalking10.4.0 version encounters an error when starting up because the kafka-fetcher is set to the SASL_SSL security mode. However, this issue does not occur with the 10.1.0 version.
### Anything else
_No response_
### Are you willing to submit a pull request to fix on your own?
- [ ] Yes I am willing to submit a pull request on my own!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP. [skywalking]
Posted by "wu-sheng (via GitHub)" <gi...@apache.org>.
wu-sheng commented on issue #13849:
URL: https://github.com/apache/skywalking/issues/13849#issuecomment-4327059873
Correction on the JIRA citation in my previous comment — the right tickets are:
- [KAFKA-18866](https://issues.apache.org/jira/browse/KAFKA-18866) — the bug report (your exact stack trace: `SaslClientCallbackHandler.handle` → `Subject.getSubject` → `UnsupportedOperationException` on JDK 23+).
- [KAFKA-17078](https://issues.apache.org/jira/browse/KAFKA-17078) — the fix ("Add SecurityManager reflective shim"), released in **kafka-clients 3.9.1** (2025-05-21) and **4.0.0** (2025-03-18). The shim reflectively dispatches between `Subject.callAs/current` (new API) and `Subject.doAs/getSubject` (old API), so a single jar runs on JDK 11 through 25.
OAP currently pins kafka-clients 3.4.0, which predates that fix.
Workarounds available today, in order of least to most invasive:
1. Run OAP on JDK 11 / 17 / 21 (the officially supported set).
2. JDK 23: pass `-Djava.security.manager=allow` to OAP — re-enables the deprecated API. Does not work on JDK 24+.
3. Don't use `SASL_SSL` until OAP bumps kafka-clients.
The supported-JDK statement still stands — JDK 24 / 25 with SASL_SSL is not in scope for this release. We can consider bumping kafka-clients to 3.9.1 in a future release; that would relax the JDK constraint for SASL paths without changing the official support matrix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP. [skywalking]
Posted by "NamanKu-tech (via GitHub)" <gi...@apache.org>.
NamanKu-tech commented on issue #13849:
URL: https://github.com/apache/skywalking/issues/13849#issuecomment-4355524782
I'd like to work on this. Will have a draft PR ready as soon as possible
.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP. [skywalking]
Posted by "wu-sheng (via GitHub)" <gi...@apache.org>.
wu-sheng commented on issue #13849:
URL: https://github.com/apache/skywalking/issues/13849#issuecomment-4326984989
This is the JDK 24+ Security Manager removal (JEP 486) hitting an old `kafka-clients` release. The line in your stack trace —
```
java.lang.UnsupportedOperationException: SubSubject is not supported
at java.base/java.lang.Subject.getSubject
at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.<init>
```
— is JDK 24 permanently disabling `Subject.getSubject(AccessControlContext)`. The Kafka client switched away from that API in 3.7.0 (KAFKA-15819), but OAP currently pins `kafka-clients` 3.4.0 (`oap-server-bom/pom.xml`), which still calls the disabled method.
Apache SkyWalking officially supports JDK 11 / 17 / 21 only — JDK 24 is out of scope, so this combination isn't supported. The reason 10.1.0 appeared to work for you is most likely that you were running it on JDK ≤ 21; the kafka-clients version is the same in 10.1.0 and 10.4.0.
If you need to run on JDK 24+, your options are:
- Run OAP on a supported JDK (11 / 17 / 21).
- Or pin to JDK ≤ 23, where `Subject.getSubject` is deprecated but still functional.
A future kafka-clients bump in OAP could relax this incidentally, but it's not on the support contract.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP. [skywalking]
Posted by "bayareaIA03 (via GitHub)" <gi...@apache.org>.
bayareaIA03 commented on issue #13849:
URL: https://github.com/apache/skywalking/issues/13849#issuecomment-4618657298
Is anybody working on this. I would like to work on this if no one else is working on this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP. [skywalking]
Posted by "wu-sheng (via GitHub)" <gi...@apache.org>.
wu-sheng closed issue #13849: Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP.
URL: https://github.com/apache/skywalking/issues/13849
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP. [skywalking]
Posted by "t00011666 (via GitHub)" <gi...@apache.org>.
t00011666 commented on issue #13849:
URL: https://github.com/apache/skywalking/issues/13849#issuecomment-4327008545
I am deploying using Docker images. Is it possible to create an OAP image version 10.4.0 that is based on JDK versions prior to 24?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org