search

edenhill / kcat

Generic command line non-JVM Apache Kafka producer and consumer
Other
5.46k stars 484 forks source link

sasl.mechanisms=SCRAM-SHA-512 not taken in account #411

Closed phthom closed 1 year ago

phthom commented 1 year ago

Hello, I am trying to get connected with a broker (running elsewhere on OpenShift 4.10). I have installed kcat 1.7.0 on macOS ventura latest version 13.1. When I try to execute kcat I always have a message saying that I should use SCRAM-SHA-512 but I specified sasl.mechanisms=SCRAM-SHA-512 in the parameters like this parameter was not taken in account. Here is the command : 

kcat -b $BROKER -P -X security.protocol=SASL_SSL -X ssl.ca.location=ca.crt -X sasl.mechanisms=SCRAM-SHA-512 -X sasl.username=cartridge-kafka-auth-0 -X sasl.password=VgfApy178QLb -v -L

Here is the response:

%3|1673019767.952|FAIL|rdkafka#producer-1| [thrd:sasl_ssl://iaf-system-kafka-bootstrap-cp4waiops.waiops-cluster-]: sasl_ssl://iaf-system-kafka-bootstrap-cluster-ams03-b3c-81e8bced210b87906b977c10143c5835-0000.eu-de.containers.appdomain.cloud:443/bootstrap: SASL PLAIN mechanism handshake failed: Broker: Unsupported SASL mechanism: broker's supported mechanisms: SCRAM-SHA-512 (after 333ms in state AUTH_HANDSHAKE)
%3|1673019768.766|FAIL|rdkafka#producer-1| [thrd:sasl_ssl://iaf-system-kafka-bootstrap-cp4waiops.waiops-cluster-]: sasl_ssl://iaf-system-kafka-bootstrap-cluster-ams03-b3c-81e8bced210b87906b977c10143c5835-0000.eu-de.containers.appdomain.cloud:443/bootstrap: SASL PLAIN mechanism handshake failed: Broker: Unsupported SASL mechanism: broker's supported mechanisms: SCRAM-SHA-512 (after 364ms in state AUTH_HANDSHAKE, 1 identical error(s) suppressed)
% Fatal error at metadata_list:1201:
% ERROR: Failed to acquire metadata: Local: Broker transport failure (Are the brokers reachable? Also try increasing the metadata timeout with -m <timeout>?)

I did many testing with other systems (Ubuntu and RHEL) and even some other macOS systems (but not ventura BTW) and it was working !!! Same kcat 1.7.0 or kafkacat, same ca.crt, same user/password ... I have something wrong on my system (I think). I also check connectivity by using -d broker. I can see my remote broker. Where should I look ? Why kcat doesn't take in account my parameter (sasl.mechanisms=SCRAM-SHA-512) ? Any idea ?

phthom commented 1 year ago

I just discovered that I did a previous installation a long time ago of kcat or even kafkacat and I found a very old ~/.config/kcat.conf in my home directory. In this kcat.conf I have this parameter sasl.mechanism=PLAIN that I certainly put also a long time ago. Apparently, this parameter is overriding the parameter that I put in the arguments of my command line. I don't know if this is a common behavior to have the config file that is overriding the arguments. I deleted the ~/.config/kcat.conf and the command worked perfect like on the other systems. Closing this issue.