SASL GSSAPI could not login

[cassanellicarlo]

Hello, i have two Kafka clusters with SASL integration for Kerberos. I use the Kerberos Ticket to authenticate to the cluster. I was using an older version of kafka-ui (for example with 0.3.3 it works) and it used to work correctly, but then i switched to the latest one and i got problems.

This is the configuration i'm using

podman run -it \
    --volume=truststore_BN_CA.jks:/opt/kafka/config/truststore.jks:rw \
    --volume=$TICKET_LOCATION:/tmp/krb5cc_0 \
    --volume=krb5.conf:/etc/krb5.conf:U \
    --env KAFKA_CLUSTERS_0_NAME='DC1' \
    --env KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=$BOOTSTRAP_SERVERS_DC1 \
    --env KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL='SASL_SSL' \
    --env KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM='GSSAPI' \
    --env KAFKA_CLUSTERS_0_PROPERTIES_SASL_KERBEROS_SERVICE_NAME='kafka' \
    --env KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG='com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true;' \
    --env KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION='/opt/kafka/config/truststore.jks' \
    --env KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD='***' \
    --env KAFKA_CLUSTERS_1_NAME='DC2' \
    --env KAFKA_CLUSTERS_1_BOOTSTRAPSERVERS=$BOOTSTRAP_SERVERS_DC2 \
    --env KAFKA_CLUSTERS_1_PROPERTIES_SECURITY_PROTOCOL='SASL_SSL' \
    --env KAFKA_CLUSTERS_1_PROPERTIES_SASL_MECHANISM='GSSAPI' \
    --env KAFKA_CLUSTERS_1_PROPERTIES_SASL_KERBEROS_SERVICE_NAME='kafka' \
    --env KAFKA_CLUSTERS_1_PROPERTIES_SASL_JAAS_CONFIG='com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true;' \
    --env KAFKA_CLUSTERS_1_PROPERTIES_SSL_TRUSTSTORE_LOCATION='/opt/kafka/config/truststore.jks' \
    --env KAFKA_CLUSTERS_1_PROPERTIES_SSL_TRUSTSTORE_PASSWORD='truststore' \
    --publish 8080:8080 \
    kafka-ui:latest

This is the error i'm getting now:

java.lang.IllegalStateException: Error while creating AdminClient for Cluster DC2
        at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$3(AdminClientServiceImpl.java:45)
        at reactor.core.publisher.Mono.lambda$onErrorMap$31(Mono.java:3733)
        at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:94)
        at reactor.core.publisher.Operators.error(Operators.java:198)
        at reactor.core.publisher.FluxFlatMap.trySubscribeScalarMap(FluxFlatMap.java:135)
        at reactor.core.publisher.MonoFlatMap.subscribeOrReturn(MonoFlatMap.java:53)
        at reactor.core.publisher.Mono.subscribe(Mono.java:4385)
        at reactor.core.publisher.FluxSwitchIfEmpty$SwitchIfEmptySubscriber.onComplete(FluxSwitchIfEmpty.java:82)
        at reactor.core.publisher.Operators.complete(Operators.java:137)
        at reactor.core.publisher.MonoEmpty.subscribe(MonoEmpty.java:46)
        at reactor.core.publisher.Mono.subscribe(Mono.java:4400)
        at reactor.core.publisher.FluxFlatMap$FlatMapMain.onNext(FluxFlatMap.java:426)
        at reactor.core.publisher.FluxPublishOn$PublishOnSubscriber.runAsync(FluxPublishOn.java:440)
        at reactor.core.publisher.FluxPublishOn$PublishOnSubscriber.run(FluxPublishOn.java:527)
        at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:84)
        at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:37)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:830)
Caused by: org.apache.kafka.common.KafkaException: Failed to create new KafkaAdminClient
        at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:540)
        at org.apache.kafka.clients.admin.Admin.create(Admin.java:134)
        at org.apache.kafka.clients.admin.AdminClient.create(AdminClient.java:39)
        at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$2(AdminClientServiceImpl.java:41)
        at reactor.core.publisher.MonoSupplier.call(MonoSupplier.java:86)
        at reactor.core.publisher.FluxFlatMap.trySubscribeScalarMap(FluxFlatMap.java:127)
        ... 16 common frames omitted
Caused by: org.apache.kafka.common.KafkaException: javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner  authentication information from the user
        at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:184)
        at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:192)
        at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:81)
        at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:105)
        at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:513)
        ... 21 common frames omitted
Caused by: javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner  authentication information from the user
        at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.promptForPass(Krb5LoginModule.java:920)
        at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:740)
        at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:592)
        at java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:726)
        at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:665)
        at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:663)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
        at java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:663)
        at java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:574)
        at org.apache.kafka.common.security.authenticator.AbstractLogin.login(AbstractLogin.java:60)
        at org.apache.kafka.common.security.kerberos.KerberosLogin.login(KerberosLogin.java:103)
        at org.apache.kafka.common.security.authenticator.LoginManager.<init>(LoginManager.java:62)
        at org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:105)
        at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:170)
        ... 25 common frames omitted

Do you have any idea?

Many thanks & regards

[Haarolean]

Hi, I'll convert this into an issue.