Getting this error after configuring Kafka on Ubuntu with SASL/OAUTHBEARER

Question

I have configured the Kafka with SASL/OAUTHBEARER but, consumers and producers when hitting the Kafka on port 9093 the Broker is validating the client correctly but, the client is continuously trying to make connection with the broker and finally not exchanging the messages. Getting the warning below and finally client is not able to produce or consume messages. I have tried with both Java and NodeJS none working.

13:46:13,731 INFO  org.apache.kafka.clients.NetworkClient                        - [Consumer clientId=admin, groupId=bp1-cg] Cancelled in-flight API_VERSIONS request with correlation id 30 due to node -1 being disconnected (elapsed time since creation: 171ms, elapsed time since send: 171ms, request timeout: 30000ms)
13:46:13,731 WARN  org.apache.kafka.clients.NetworkClient                        - [Consumer clientId=admin, groupId=bp1-cg] Bootstrap broker 158.177.250.15:9093 (id: -1 rack: null) disconnected

Answer 1

I faced a similar issue. In my case, this is caused by a connection session lifetime set to 0ms after the SASL client state is COMPLETED. Since this is set to 0ms, the client will get disconnected immediately.

I will suggest to check your log by enabling this logger in your log4j.properties:

log4j.logger.org.apache.kafka.common.security=DEBUG

In my case, I saw this debug log stating a weird expiration time that I found useful to understand what the issue was:

Jan 28 03:26:48 vmi11111.contaboserver.net kafka-server-start.sh[2128284]: [2024-01-28 03:26:48,670] DEBUG Authentication complete; session max lifetime from broker config=0 ms, credential expiration=Tue Jan 20 19:00:12 CET 1970 (-1704702396264 ms); session expiration = Sun Jan 28 03:26:48 CET 2024 (0 ms), sending 0 ms to client (org.apache.kafka.common.security.authenticator.SaslServerAuthenticator)

I'm using SASL_SSL with OAUTHBEARER mechanism with custom AuthenticateCallbackHandler and OAuthBearerToken. In my implementation, I mistakenly set the value returned by lifetimeMs() and startTimeMs() functions in seconds unit, where it is supposed to be in milliseconds unit. exp and iat from jwt claims are in second so I need to multiply it by 1000 before returning it from the function to fix this issue.

Hope it helps!