[jira] [Commented] (KAFKA-7631) NullPointerException when SCRAM is allowed bu ScramLoginModule is not in broker's jaas.conf

["Jun Wang (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-7631?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17108677#comment-17108677 ] 

Jun Wang commented on KAFKA-7631:
---------------------------------

This is a JAAS config issue, For example putting PlainLoginModule inside a scram configuration.

 
{noformat}
sasl_scram.KafkaServer {
 org.apache.kafka.common.security.plain.PlainLoginModule optional
 username="admin"
 password="admin-secret"
 user_admin="admin-secret";
}; 
{noformat}
To fix the NullPointerException. I looked at SaslServerAuthenticator.java code, just need to add one line inside createSaslServer function. 

According the [java Sasl document|[https://docs.oracle.com/javase/8/docs/api/javax/security/sasl/Sasl.html#createSaslServer-java.lang.String-java.lang.String-java.lang.String-java.util.Map-javax.security.auth.callback.CallbackHandler-] ]

Returns:A possibly null {{SaslServer}} created using the parameters supplied. If null, cannot find a {{SaslServerFactory}} that will produce one.

also changed line 288 from LOG.debug to LOG.error 
{noformat}
LOG.error("Failed during {}: {}", reauthInfo.authenticationOrReauthenticationText(), e.getMessage());{noformat}
Log file shows following error after fix.

 
{noformat}
[2020-05-15 17:21:54,521] ERROR Failed during authentication: Kafka Server failed to create a SaslServer to interact with a client during session authentication (org.apache.kafka.common.security.authenticator.SaslServerAuthenticator) 
{noformat}
patch file attached. 

 

> NullPointerException when SCRAM is allowed bu ScramLoginModule is not in broker's jaas.conf
> -------------------------------------------------------------------------------------------
>
>                 Key: KAFKA-7631
>                 URL: https://issues.apache.org/jira/browse/KAFKA-7631
>             Project: Kafka
>          Issue Type: Improvement
>          Components: security
>    Affects Versions: 2.0.0
>            Reporter: Andras Beni
>            Assignee: Viktor Somogyi-Vass
>            Priority: Minor
>
> When user wants to use delegation tokens and lists {{SCRAM}} in {{sasl.enabled.mechanisms}}, but does not add {{ScramLoginModule}} to broker's JAAS configuration, a null pointer exception is thrown on broker side and the connection is closed.
> Meaningful error message should be logged and sent back to the client.
> {code}
> java.lang.NullPointerException
>         at org.apache.kafka.common.security.authenticator.SaslServerAuthenticator.handleSaslToken(SaslServerAuthenticator.java:376)
>         at org.apache.kafka.common.security.authenticator.SaslServerAuthenticator.authenticate(SaslServerAuthenticator.java:262)
>         at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:127)
>         at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:489)
>         at org.apache.kafka.common.network.Selector.poll(Selector.java:427)
>         at kafka.network.Processor.poll(SocketServer.scala:679)
>         at kafka.network.Processor.run(SocketServer.scala:584)
>         at java.lang.Thread.run(Thread.java:748)
> {code}



--
This message was sent by Atlassian Jira
(v8.3.4#803005)