KRaft controller listener with SASL SCRAM-SHA-512

[Robin <ro...@rablet.dev>]

Hi,

I've been trying to get SASL using SCRAM-SHA-512 up and running in Kafka
3.5 but I've been running into some issues which I'm not sure how to debug.

I'm able to authenticate when I use PLAIN and the following kafka_jaas.conf:

KafkaServer {
   org.apache.kafka.common.security.plain.PlainLoginModule required
   username="mybrokeruser"
   password="mybrokerpassword";
   };

I then try to change sasl.mechanism.controller.protocol from PLAIN to
SCRAM-SHA-512, run kafka-storage.sh format with --add-scram and change my
kafka_jaas.conf:

KafkaServer {
   org.apache.kafka.common.security.scram.ScramLoginModule required
   username="mybrokeruser"
   password="mybrokerpassword";
   };

At that point I keep getting authentication errors and I'm not sure how to
debug it or find out which credentials are used. I tried setting all
loggers to TRACE but I wasn't able to figure it out.

It's working on my other listeners (INTERNAL, CLIENT, EXTERNAL) but I can't
seem to get it working for the CONTROLLER listener for the KRaft
communication.

Any pointers for how to debug this would be much appreciated!


Kind Regards,

Robin

RE: KRaft controller listener with SASL SCRAM-SHA-512

[mi...@votecgroup.com]

Hi Team,

Greetings,

We actually reached out to you for Oracle/ IT / SAP / Infor / Microsoft "VOTEC IT SERVICE PARTNERSHIP"  "IT SERVICE OUTSOURCING" " "PARTNER SERVICE SUBCONTRACTING"

We have very attractive newly introduce reasonably price PARTNER IT SERVICE ODC SUBCONTRACTING MODEL in USA, Philippines, India and Singapore etc with White Label Model.

Our LOW COST IT SERVICE ODC MODEL eliminate the cost of expensive employee payroll, Help partner to get profit more than 50% on each project.. ..We really mean it.

We are already working with platinum partner like NTT DATA, NEC Singapore, Deloitte, Hitachi consulting. ACCENTURE, Abeam Singapore etc.

Are u keen to understand VOTEC IT PARTNERSHIP offerings? Looping KB kailash@votecgroup.com | Partnership In charge |

Let us know your availability this week OR Next week??

-----Original Message-----
From: Robin [mailto:robin@rablet.dev] 
Sent: 28 July 2023 14:34
To: users@kafka.apache.org
Subject: KRaft controller listener with SASL SCRAM-SHA-512

Hi,

I've been trying to get SASL using SCRAM-SHA-512 up and running in Kafka
3.5 but I've been running into some issues which I'm not sure how to debug.

I'm able to authenticate when I use PLAIN and the following kafka_jaas.conf:

KafkaServer {
   org.apache.kafka.common.security.plain.PlainLoginModule required
   username="mybrokeruser"
   password="mybrokerpassword";
   };

I then try to change sasl.mechanism.controller.protocol from PLAIN to SCRAM-SHA-512, run kafka-storage.sh format with --add-scram and change my
kafka_jaas.conf:

KafkaServer {
   org.apache.kafka.common.security.scram.ScramLoginModule required
   username="mybrokeruser"
   password="mybrokerpassword";
   };

At that point I keep getting authentication errors and I'm not sure how to debug it or find out which credentials are used. I tried setting all loggers to TRACE but I wasn't able to figure it out.

It's working on my other listeners (INTERNAL, CLIENT, EXTERNAL) but I can't seem to get it working for the CONTROLLER listener for the KRaft communication.

Any pointers for how to debug this would be much appreciated!


Kind Regards,

Robin