{
  "id": "kafka/sasl-authentication-failure",
  "signature": "org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed due to invalid credentials",
  "signature_zh": "SASL认证异常：由于无效凭证导致认证失败",
  "regex": "SaslAuthenticationException.*Authentication failed.*invalid credentials",
  "domain": "kafka",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "Kafka client provided incorrect username or password for SASL/PLAIN or SASL/SCRAM authentication.",
  "root_cause_type": "generic",
  "root_cause_zh": "Kafka客户端为SASL/PLAIN或SASL/SCRAM认证提供了错误的用户名或密码。",
  "versions": [],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Re-adding the same credentials in JAAS file without verifying against the broker's credential store will fail.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Disabling SASL entirely removes security, which is not acceptable in production.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Update JAAS config with correct credentials: sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username=\"user\" password=\"pass\";",
      "success_rate": 0.9,
      "how": "Update JAAS config with correct credentials: sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username=\"user\" password=\"pass\";",
      "condition": "",
      "sources": []
    },
    {
      "action": "Reset the SCRAM credential on the broker: kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user",
      "success_rate": 0.85,
      "how": "Reset the SCRAM credential on the broker: kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user",
      "condition": "",
      "sources": []
    },
    {
      "action": "Check broker logs for authentication failures to identify the exact credential mismatch.",
      "success_rate": 0.8,
      "how": "Check broker logs for authentication failures to identify the exact credential mismatch.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "使用正确的凭证更新JAAS配置：sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username=\"user\" password=\"pass\";",
    "在代理上重置SCRAM凭证：kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user",
    "检查代理日志以查找认证失败，确定确切的凭证不匹配。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://kafka.apache.org/documentation/#security_sasl",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.86,
  "fix_success_rate": 0.88,
  "resolvable": "true",
  "first_seen": "2024-04-05",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}