[
https://issues.apache.org/jira/browse/KAFKA-7631?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17108677#comment-17108677
]
Jun Wang edited comment on KAFKA-7631 at 5/15/20, 9:36 PM:
-----------------------------------------------------------
This is a JAAS config issue, For example putting PlainLoginModule inside a
scram configuration.
{noformat}
sasl_scram.KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule optional
username="admin"
password="admin-secret"
user_admin="admin-secret";
};
{noformat}
According
[https://docs.oracle.com/javase/8/docs/api/javax/security/sasl/Sasl.html]
Returns:A possibly null {{SaslServer}} created using the parameters supplied.
If null, cannot find a {{SaslServerFactory}} that will produce one.
To fix the NullPointerException. just need to add one line inside
SaslServerAuthenticator.createSaslServer function.
Also changed line 288 from LOG.debug to LOG.error
{noformat}
} catch (Exception e) {
// In the case of IOExceptions and other unexpected exceptions, fail
immediately
saslState = SaslState.FAILED;
LOG.error("Failed during {}: {}",
reauthInfo.authenticationOrReauthenticationText(), e.getMessage());
throw e;
}
{noformat}
Log file shows following error after fix.
{noformat}
[2020-05-15 17:21:54,521] ERROR Failed during authentication: Kafka Server
failed to create a SaslServer to interact with a client during session
authentication
(org.apache.kafka.common.security.authenticator.SaslServerAuthenticator)
{noformat}
patch file attached.
was (Author: wj1918):
This is a JAAS config issue, For example putting PlainLoginModule inside a
scram configuration.
{noformat}
sasl_scram.KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule optional
username="admin"
password="admin-secret"
user_admin="admin-secret";
};
{noformat}
To fix the NullPointerException. I looked at SaslServerAuthenticator.java code,
just need to add one line inside createSaslServer function.
According
[https://docs.oracle.com/javase/8/docs/api/javax/security/sasl/Sasl.html]
Returns:A possibly null {{SaslServer}} created using the parameters supplied.
If null, cannot find a {{SaslServerFactory}} that will produce one.
also changed line 288 from LOG.debug to LOG.error
{noformat}
LOG.error("Failed during {}: {}",
reauthInfo.authenticationOrReauthenticationText(), e.getMessage());{noformat}
Log file shows following error after fix.
{noformat}
[2020-05-15 17:21:54,521] ERROR Failed during authentication: Kafka Server
failed to create a SaslServer to interact with a client during session
authentication
(org.apache.kafka.common.security.authenticator.SaslServerAuthenticator)
{noformat}
patch file attached.
> NullPointerException when SCRAM is allowed bu ScramLoginModule is not in
> broker's jaas.conf
> -------------------------------------------------------------------------------------------
>
> Key: KAFKA-7631
> URL: https://issues.apache.org/jira/browse/KAFKA-7631
> Project: Kafka
> Issue Type: Improvement
> Components: security
> Affects Versions: 2.0.0
> Reporter: Andras Beni
> Assignee: Viktor Somogyi-Vass
> Priority: Minor
>
> When user wants to use delegation tokens and lists {{SCRAM}} in
> {{sasl.enabled.mechanisms}}, but does not add {{ScramLoginModule}} to
> broker's JAAS configuration, a null pointer exception is thrown on broker
> side and the connection is closed.
> Meaningful error message should be logged and sent back to the client.
> {code}
> java.lang.NullPointerException
> at
> org.apache.kafka.common.security.authenticator.SaslServerAuthenticator.handleSaslToken(SaslServerAuthenticator.java:376)
> at
> org.apache.kafka.common.security.authenticator.SaslServerAuthenticator.authenticate(SaslServerAuthenticator.java:262)
> at
> org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:127)
> at
> org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:489)
> at org.apache.kafka.common.network.Selector.poll(Selector.java:427)
> at kafka.network.Processor.poll(SocketServer.scala:679)
> at kafka.network.Processor.run(SocketServer.scala:584)
> at java.lang.Thread.run(Thread.java:748)
> {code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
