Kafka authentication with scram 512 and KRAFT mode doesn't work

Question

Kafka authentication with scram 512 and KRAFT mode doesn't work. My docker compose looks like this.

services:
  kafka-1:
    image: confluentinc/cp-kafka:7.7.1
    ports:
      - '9092:9092'
    environment:
      CLUSTER_ID: apCvyf6zusVSAvyqGAh7AZ
      KAFKA_NODE_ID: 1
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: 'CONTROLLER:SASL_PLAINTEXT,CLIENT:SASL_PLAINTEXT,BROKER:SASL_PLAINTEXT'
      KAFKA_ADVERTISED_LISTENERS: 'CLIENT://kafka-1:29092,BROKER://localhost:9092'
      KAFKA_PROCESS_ROLES: 'broker,controller'
      KAFKA_CONTROLLER_QUORUM_VOTERS: '1@kafka-1:9093'
      KAFKA_LISTENERS: 'CLIENT://0.0.0.0:29092,CONTROLLER://0.0.0.0:9093,BROKER://0.0.0.0:9092'
      KAFKA_INTER_BROKER_LISTENER_NAME: BROKER
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_SASL_MECHANISM_CONTROLLER_PROTOCOL: SCRAM-SHA-512
      KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: SCRAM-SHA-512
      KAFKA_SASL_ENABLED_MECHANISMS: SCRAM-SHA-512
      KAFKA_AUTHORIZER_CLASS_NAME: org.apache.kafka.metadata.authorizer.StandardAuthorizer
      KAFKA_SUPER_USERS: 'User:admin'
      KAFKA_OPTS: '-Djava.security.auth.login.config=/etc/kafka/kafka_jaas.conf'
    volumes:
      - ./config/kafka_jaas.conf:/etc/kafka/kafka_jaas.conf 
      
  kafka-ui:
    image: provectuslabs/kafka-ui:latest
    ports:
      - 1111:1111
    environment:
      SERVER_PORT: 1111
      KAFKA_CLUSTERS_0_NAME: local
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka-1:29092
      KAFKA_CLUSTERS_0_ZOOKEEPER: zookeeper:2181
      KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SASL_PLAINTEXT
      KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM: SCRAM-SHA-512
      KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG: 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="admin_password";'

And the jaas file

KafkaServer {
  org.apache.kafka.common.security.scram.ScramLoginModule required
  username="admin"
  password="admin_password"
  user_admin="admin_password"
  user_service="service_password";
};

This is the error I get

kafka-1_1   | [2024-10-28 13:42:04,650] ERROR [controller-1-to-controller-registration-channel-manager]: Request ControllerRegistrationRequestData(controllerId=1, incarnationId=NZkn4xOFS42Kg0RhscJHVw, zkMigrationReady=false, listeners=[Listener(name='CONTROLLER', host='0.0.0.0', port=9093, securityProtocol=2)], features=[Feature(name='metadata.version', minSupportedVersion=1, maxSupportedVersion=19)]) failed due to authentication error with controller (kafka.server.NodeToControllerRequestThread)
kafka-1_1   | org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512
kafka-1_1   | [2024-10-28 13:42:04,650] ERROR [ControllerRegistrationManager id=1 incarnation=NZkn4xOFS42Kg0RhscJHVw] RegistrationResponseHandler: authentication error (kafka.server.ControllerRegistrationManager)
kafka-1_1   | org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512

If i change SASL mechanism to PLAIN, everything works?

Dinesh Kumar L · Accepted Answer · 2025-06-09 06:57:30Z

1

I have Apache Kraft 4.0.0 on local (Linux) trying to configure SASL_SSL scram 512.
The SSL works fine. However, the SASL_SSL plaintext or any other method throws me an error "Failed to initiate SASL authenticator error". Hence, I remained at SSL for controller to controller and configured SASL_SSL scram 512 for broker to broker and other clients.
Don't know if this is a limitation with controller-to-controller setup for SASL_SSL. Any suggestion or assistance is appreciated! thanks!

edited Jun 9 at 6:57

answered Mar 29 at 11:31

Dinesh Kumar L

313 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Community Mar 30 at 0:31

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.

Collectives™ on Stack Overflow

Kafka authentication with scram 512 and KRAFT mode doesn't work

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related