Can not connect to kafka brokers with SASL_SSL and SASL_MECHANISM = PLAIN #3150

kart-hg-git · 2022-12-23T11:33:21Z

kart-hg-git
Dec 23, 2022

Hello Team,

I have used your latest jar(v0.4.0) from the release. And was able to deploy that to cloud foundry successfully using the config params defined in [https://github.com/provectus/kafka-ui/blob/master/documentation/compose/kafka-ssl.yml].

Have also bound the kafka service instance to the app and have configured below properties as User defined ENVs

KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS  broker1:9093,broker2:9093,broker3:9093     
KAFKA_CLUSTERS_0_PROPERTIES_PROTOCOL    SASL 
KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG org.apache.kafka.common.security.plain.PlainLoginModule required username="<username>" password="<password>";    
KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM   PLAIN     
KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL     SASL_SSL  
KAFKA_CLUSTERS_0_PROPERTIES_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM          
KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_LOCATION ./kafkaKeyStore.jks 
KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_PASSWORD kafkaTool 
KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION    ./kafkaKeyStore.jks 
KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD    kafkaTool

I get the following error:

2022-12-23T16:31:10.64+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,642 INFO  [kafka-admin-client-thread | adminclient-2] o.a.k.c.n.Selector: [AdminClient clientId=adminclient-2] Failed authentication with ip-XX-XX-XX-XX.eu-central-1.compute.internal/XX.XX.XX.XX (Authentication failed: credentials for user could not be verified)
   2022-12-23T16:31:10.64+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,642 ERROR [kafka-admin-client-thread | adminclient-2] o.a.k.c.NetworkClient: [AdminClient clientId=adminclient-2] Connection to node -3 (ip-XX-XX-XX-XX.eu-central-1.compute.internal/XX.XX.XX.XX:9093) failed authentication due to: Authentication failed: credentials for user could not be verified
   2022-12-23T16:31:10.64+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,642 WARN  [kafka-admin-client-thread | adminclient-2] o.a.k.c.a.i.AdminMetadataManager: [AdminClient clientId=adminclient-2] Metadata update failed due to authentication error
   2022-12-23T16:31:10.64+0530 [APP/PROC/WEB/0] OUT org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed: credentials for user could not be verified
   2022-12-23T16:31:10.65+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,656 INFO  [kafka-admin-client-thread | adminclient-1] o.a.k.c.n.Selector: [AdminClient clientId=adminclient-1] Failed authentication with ip-XX-XX-XX-XX.eu-central-1.compute.internal/XX.XX.XX.XX (Authentication failed: credentials for user could not be verified)
   2022-12-23T16:31:10.65+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,656 ERROR [kafka-admin-client-thread | adminclient-1] o.a.k.c.NetworkClient: [AdminClient clientId=adminclient-1] Connection to node -2 (ip-XX-XX-XX-XX.eu-central-1.compute.internal/XX.XX.XX.XX:9093) failed authentication due to: Authentication failed: credentials for user could not be verified
   2022-12-23T16:31:10.65+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,656 WARN  [kafka-admin-client-thread | adminclient-1] o.a.k.c.a.i.AdminMetadataManager: [AdminClient clientId=adminclient-1] Metadata update failed due to authentication error
   2022-12-23T16:31:10.65+0530 [APP/PROC/WEB/0] OUT org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed: credentials for user could not be verified
   2022-12-23T16:31:10.66+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,665 INFO  [kafka-admin-client-thread | adminclient-2] o.a.k.c.a.i.AdminMetadataManager: [AdminClient clientId=adminclient-2] Metadata update failed
   2022-12-23T16:31:10.66+0530 [APP/PROC/WEB/0] OUT org.apache.kafka.common.errors.TimeoutException: Call(callName=fetchMetadata, deadlineMs=1671793270664, tries=1, nextAllowedTryMs=1671793270765) timed out at 1671793270665 after 1 attempt(s)
   2022-12-23T16:31:10.66+0530 [APP/PROC/WEB/0] OUT Caused by: org.apache.kafka.common.errors.TimeoutException: Timed out waiting to send the call. Call: fetchMetadata
   2022-12-23T16:31:10.69+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,695 INFO  [kafka-admin-client-thread | adminclient-3] o.a.k.c.a.i.AdminMetadataManager: [AdminClient clientId=adminclient-3] Metadata update failed
   2022-12-23T16:31:10.69+0530 [APP/PROC/WEB/0] OUT org.apache.kafka.common.errors.TimeoutException: Call(callName=fetchMetadata, deadlineMs=1671793270694, tries=1, nextAllowedTryMs=1671793270795) timed out at 1671793270695 after 1 attempt(s)
   2022-12-23T16:31:10.69+0530 [APP/PROC/WEB/0] OUT Caused by: org.apache.kafka.common.errors.TimeoutException: Timed out waiting to send the call. Call: fetchMetadata
   2022-12-23T16:31:10.70+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,705 INFO  [kafka-admin-client-thread | adminclient-3] o.a.k.c.n.Selector: [AdminClient clientId=adminclient-3] Failed authentication with ip-XX-XX-XX-XX.eu-central-1.compute.internal/XX.XX.XX.XX (Authentication failed: credentials for user could not be verified)
   2022-12-23T16:31:10.70+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,705 ERROR [kafka-admin-client-thread | adminclient-3] o.a.k.c.NetworkClient: [AdminClient clientId=adminclient-3] Connection to node -2 (ip-XX-XX-XX-XX.eu-central-1.compute.internal/XX.XX.XX.XX:9093) failed authentication due to: Authentication failed: credentials for user could not be verified
   2022-12-23T16:31:10.70+0530 [APP/PROC/WEB/0] OUT 2022-12-23 11:01:10,706 WARN  [kafka-admin-client-thread | adminclient-3] o.a.k.c.a.i.AdminMetadataManager: [AdminClient clientId==adminclient-3] Metadata update failed due to authentication error

Please clarify if I have missed something

Answered by Haarolean

Dec 27, 2022

Hey, we've got a case working with cloud foundry before (#1828) with SASL_SSL.
I'll convert this into a discussion since it's not a problem with the app.

I can suggest trying this locally first to verify it works on an env controlled by you.

View full answer

Haarolean · 2022-12-27T09:41:30Z

Haarolean
Dec 27, 2022

Hey, we've got a case working with cloud foundry before (#1828) with SASL_SSL.
I'll convert this into a discussion since it's not a problem with the app.

I can suggest trying this locally first to verify it works on an env controlled by you.

0 replies

kart-hg-git · 2023-01-04T12:14:36Z

kart-hg-git
Jan 4, 2023
Author

@Thilaknath , Would you be able to comment here?

0 replies

kart-hg-git · 2023-01-06T11:37:12Z

kart-hg-git
Jan 6, 2023
Author

@Haarolean , I was able to connect to the cluster with offline discussion with @Thilaknath. But when the app's URL is launched I get 404 with SERVER_SERVLET_CONTEXT_PATH set as /kafka-ui. I referrred to one of the issues raised here - #2346.

Any hint here to launch the right end-point?

Regards

7 replies

Haarolean Jan 11, 2023

@kart-hg-git so are you building from the source or? You've mentioned "I have used your latest jar(v0.4.0) from the release" in the first message.
Either way, #2346 has been fixed within 0.5, so it's' not present in 0.4.0. Can you check the latest one if you're not on one already?

kart-hg-git Jan 12, 2023
Author

@Haarolean, Initially i tried with v0.4.0 jar. But later when i understood there is some customisations required to connect to my cluster , I forked your latest source from the repo, made necessary changes, built jar out of it and deployed that to cf. I am able to succesfully connect to the cluster but the UI URL when launched gives following error,

{"code":5000,"message":"class path resource [static/index.html] cannot be opened because it does not exist","timestamp":1673501977675,"requestId":"f4c3e2a8-183","fieldsErrors":null,"stackTrace":"java.io.FileNotFoundException: class path resource [static/index.html] cannot be opened because it does not exist\n\tat org.springframework.core.io.ClassPathResource.getInputStream(ClassPathResource.java:199)\n\tSuppressed: The stacktrace has been enhanced by Reactor

Also parallelly , i have tried to connect to the cluster using the hosted URL from cf in your kafka-ui-react-app by following README.md. UI loads correctly and I am able to connect to my kafka cluster and see the brokers, topics, messages, etc.

Should I host your kafka-ui-react-app on cf , is it a separate app to be hosted as such. Does the jar built out of java app include this?
If yes, Any steps to host react app on cf ? What's the purpose of this app ? Any more info on this app?

Haarolean Jan 12, 2023

@kart-hg-git what modifications are you talking about tho? Really curious, isn't it something that we'd like to want to have to support some clusters as well?

Considering the missing static/index.html, I have a feeling you've built the jar with the wrong profiles. You have to build it with prod profile :)

kart-hg-git Jan 13, 2023
Author

@Haarolean , The modifications are specific to the cluster i'm using internally. The structure of service-key, the certs used for ssl handshake are tightly coupled to the way the kafka service been implemented/exposed in the cf. Not sure if it would help in generic implementation of the tool holistically.

Thanks for providing the hint for using the right profile. It now works perfectly !!

gitomat01 Mar 22, 2024

@kart-hg-git : can please tell us where you make the changes to use the prod profile. I have a git clone of the code and compile it locally and got the same error as you. Thx.

kart-hg-git · 2023-01-13T09:43:03Z

kart-hg-git
Jan 13, 2023
Author

2 replies

Haarolean Jan 13, 2023

Glad to hear that, let us know if you have any other problems.

kart-hg-git Jan 13, 2023
Author

Thanks again!!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can not connect to kafka brokers with SASL_SSL and SASL_MECHANISM = PLAIN #3150

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 9 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Can not connect to kafka brokers with SASL_SSL and SASL_MECHANISM = PLAIN #3150

kart-hg-git Dec 23, 2022

Replies: 4 comments · 9 replies

Haarolean Dec 27, 2022

kart-hg-git Jan 4, 2023 Author

kart-hg-git Jan 6, 2023 Author

Haarolean Jan 11, 2023

kart-hg-git Jan 12, 2023 Author

Haarolean Jan 12, 2023

kart-hg-git Jan 13, 2023 Author

gitomat01 Mar 22, 2024

kart-hg-git Jan 13, 2023 Author

Haarolean Jan 13, 2023

kart-hg-git Jan 13, 2023 Author

kart-hg-git
Dec 23, 2022

Replies: 4 comments 9 replies

Haarolean
Dec 27, 2022

kart-hg-git
Jan 4, 2023
Author

kart-hg-git
Jan 6, 2023
Author

kart-hg-git Jan 12, 2023
Author

kart-hg-git Jan 13, 2023
Author

kart-hg-git
Jan 13, 2023
Author

kart-hg-git Jan 13, 2023
Author