{
  "id": "kafka/unsupported-sasl-mechanism",
  "signature": "org.apache.kafka.common.errors.UnsupportedSaslMechanismException: The broker does not support the SASL mechanism PLAIN",
  "signature_zh": "org.apache.kafka.common.errors.UnsupportedSaslMechanismException: 代理不支持 SASL 机制 PLAIN",
  "regex": "org\\.apache\\.kafka\\.common\\.errors\\.UnsupportedSaslMechanismException: The broker does not support the SASL mechanism .*",
  "domain": "kafka",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "The client configured a SASL mechanism (e.g., PLAIN) that is not enabled in the broker's sasl.enabled.mechanisms configuration.",
  "root_cause_type": "generic",
  "root_cause_zh": "客户端配置了代理的 sasl.enabled.mechanisms 配置中未启用的 SASL 机制（例如 PLAIN）。",
  "versions": [
    {
      "version": "Kafka 2.8.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Kafka 3.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Kafka 3.4.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Kafka 3.6.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Change the client's SASL mechanism to SCRAM-SHA-256 without enabling it on the broker",
      "why_fails": "If SCRAM-SHA-256 is also not in sasl.enabled.mechanisms, the same error occurs; the broker must have the mechanism enabled.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "Restart the broker after modifying JAAS config only",
      "why_fails": "JAAS config provides credentials but does not enable the mechanism; sasl.enabled.mechanisms must be set in server.properties.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Enable the required SASL mechanism in the broker's server.properties:\n\nsasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256\n\nThen restart the broker. Ensure the JAAS file also configures the mechanism's login module:\n\nKafkaServer {\n    org.apache.kafka.common.security.plain.PlainLoginModule required\n    username=\"admin\"\n    password=\"admin-secret\"\n    user_admin=\"admin-secret\"\n    user_alice=\"alice-secret\";\n};",
      "success_rate": 0.95,
      "how": "Enable the required SASL mechanism in the broker's server.properties:\n\nsasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256\n\nThen restart the broker. Ensure the JAAS file also configures the mechanism's login module:\n\nKafkaServer {\n    org.apache.kafka.common.security.plain.PlainLoginModule required\n    username=\"admin\"\n    password=\"admin-secret\"\n    user_admin=\"admin-secret\"\n    user_alice=\"alice-secret\";\n};",
      "condition": "",
      "sources": []
    },
    {
      "action": "On the client side, switch to a mechanism that the broker already supports. Check the broker logs for supported mechanisms or query via kafka-configs:\n\nkafka-configs --bootstrap-server localhost:9092 --entity-type brokers --entity-name 0 --describe --all | grep sasl.enabled.mechanisms",
      "success_rate": 0.85,
      "how": "On the client side, switch to a mechanism that the broker already supports. Check the broker logs for supported mechanisms or query via kafka-configs:\n\nkafka-configs --bootstrap-server localhost:9092 --entity-type brokers --entity-name 0 --describe --all | grep sasl.enabled.mechanisms",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Enable the required SASL mechanism in the broker's server.properties:\n\nsasl.enabled.mechanisms=PLAIN,SCRAM-SHA-256\n\nThen restart the broker. Ensure the JAAS file also configures the mechanism's login module:\n\nKafkaServer {\n    org.apache.kafka.common.security.plain.PlainLoginModule required\n    username=\"admin\"\n    password=\"admin-secret\"\n    user_admin=\"admin-secret\"\n    user_alice=\"alice-secret\";\n};",
    "On the client side, switch to a mechanism that the broker already supports. Check the broker logs for supported mechanisms or query via kafka-configs:\n\nkafka-configs --bootstrap-server localhost:9092 --entity-type brokers --entity-name 0 --describe --all | grep sasl.enabled.mechanisms"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://kafka.apache.org/documentation/#brokerconfigs_sasl.enabled.mechanisms",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.87,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2023-02-14",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}