kafka auth_error ai_generated true

org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed due to invalid credentials

ID: kafka/sasl-authentication-failure

Also available as: JSON · Markdown · 中文
88%Fix Rate
86%Confidence
1Evidence
2024-04-05First Seen

Root Cause

Kafka client provided incorrect username or password for SASL/PLAIN or SASL/SCRAM authentication.

generic

中文

Kafka客户端为SASL/PLAIN或SASL/SCRAM认证提供了错误的用户名或密码。

Official Documentation

https://kafka.apache.org/documentation/#security_sasl

Workarounds

  1. 90% success Update JAAS config with correct credentials: sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass"; 
    Update JAAS config with correct credentials: sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass";
  2. 85% success Reset the SCRAM credential on the broker: kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user 
    Reset the SCRAM credential on the broker: kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user
  3. 80% success Check broker logs for authentication failures to identify the exact credential mismatch. 
    Check broker logs for authentication failures to identify the exact credential mismatch.

中文步骤

  1. 使用正确的凭证更新JAAS配置：sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass";
  2. 在代理上重置SCRAM凭证：kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user
  3. 检查代理日志以查找认证失败，确定确切的凭证不匹配。

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Re-adding the same credentials in JAAS file without verifying against the broker's credential store will fail.

  2. 95% fail

    Disabling SASL entirely removes security, which is not acceptable in production.