{
  "id": "kafka/sasl-authentication-failed",
  "signature": "org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed due to invalid credentials with SASL mechanism SCRAM-SHA-256",
  "signature_zh": "SASL认证异常：使用SCRAM-SHA-256机制时因无效凭据认证失败",
  "regex": "SaslAuthenticationException: Authentication failed due to invalid credentials with SASL mechanism",
  "domain": "kafka",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "Kafka client provided incorrect username or password for SASL/SCRAM authentication, or the credential is not stored in ZooKeeper.",
  "root_cause_type": "generic",
  "root_cause_zh": "Kafka客户端提供了错误的用户名或密码进行SASL/SCRAM认证，或者凭据未存储在ZooKeeper中。",
  "versions": [
    {
      "version": "Kafka 3.6.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Kafka 3.7.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "The client still uses the old password, causing repeated authentication failures.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "It is a security risk and not a fix; it also requires broker reconfiguration.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Verify credentials with `kafka-configs.sh --bootstrap-server localhost:9092 --entity-type users --entity-name myuser --describe` to ensure the user exists and has correct SCRAM credentials.",
      "success_rate": 0.85,
      "how": "Verify credentials with `kafka-configs.sh --bootstrap-server localhost:9092 --entity-type users --entity-name myuser --describe` to ensure the user exists and has correct SCRAM credentials.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Recreate the SCRAM credential: `kafka-configs.sh --bootstrap-server localhost:9092 --entity-type users --entity-name myuser --alter --add-config 'SCRAM-SHA-256=[password=newpass]'` and update client JAAS file accordingly.",
      "success_rate": 0.9,
      "how": "Recreate the SCRAM credential: `kafka-configs.sh --bootstrap-server localhost:9092 --entity-type users --entity-name myuser --alter --add-config 'SCRAM-SHA-256=[password=newpass]'` and update client JAAS file accordingly.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Example client JAAS config: `KafkaClient { org.apache.kafka.common.security.scram.ScramLoginModule required username=\"myuser\" password=\"newpass\"; };`",
      "success_rate": 0.88,
      "how": "Example client JAAS config: `KafkaClient { org.apache.kafka.common.security.scram.ScramLoginModule required username=\"myuser\" password=\"newpass\"; };`",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Verify credentials with `kafka-configs.sh --bootstrap-server localhost:9092 --entity-type users --entity-name myuser --describe` to ensure the user exists and has correct SCRAM credentials.",
    "Recreate the SCRAM credential: `kafka-configs.sh --bootstrap-server localhost:9092 --entity-type users --entity-name myuser --alter --add-config 'SCRAM-SHA-256=[password=newpass]'` and update client JAAS file accordingly.",
    "Example client JAAS config: `KafkaClient { org.apache.kafka.common.security.scram.ScramLoginModule required username=\"myuser\" password=\"newpass\"; };`"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://kafka.apache.org/documentation/#security_sasl_scram",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.87,
  "fix_success_rate": 0.8,
  "resolvable": "true",
  "first_seen": "2024-03-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}