# org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed due to invalid credentials

- **ID:** `kafka/sasl-authentication-failure`
- **Domain:** kafka
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 88%

## Root Cause

Kafka client provided incorrect username or password for SASL/PLAIN or SASL/SCRAM authentication.

## Workarounds

1. **Update JAAS config with correct credentials: sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass";** (90% success)
   ```
   Update JAAS config with correct credentials: sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="pass";
   ```
2. **Reset the SCRAM credential on the broker: kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user** (85% success)
   ```
   Reset the SCRAM credential on the broker: kafka-configs.sh --bootstrap-server localhost:9092 --alter --add-config 'SCRAM-SHA-256=[password=newpass]' --entity-type users --entity-name user
   ```
3. **Check broker logs for authentication failures to identify the exact credential mismatch.** (80% success)
   ```
   Check broker logs for authentication failures to identify the exact credential mismatch.
   ```

## Dead Ends

- **** — Re-adding the same credentials in JAAS file without verifying against the broker's credential store will fail. (90% fail)
- **** — Disabling SASL entirely removes security, which is not acceptable in production. (95% fail)