Kafka connect distributed with Kerberos on Windows : Cannot locate default realm

[Olivier Norture]

Hello all,

I'm try to run the kafka-connect on Windows to send data into my kafka brocker with Kerberos.

(I love challenge !)

To do this, I have followed this link : https://docs.confluent.io/current/kafka/authentication_sasl/authentication_sasl_gssapi.html#kconnect-long

But I've got this error :

INFO org.apache.kafka.common.network.SaslChannelBuilder Failed to create channel due to

org.apache.kafka.common.errors.SaslAuthenticationException: Failed to configure SaslClientAuthenticator

Caused by: org.apache.kafka.common.errors.SaslAuthenticationException: Failed to create SaslClient with mechanism GSSAPI

Caused by: javax.security.sasl.SaslException: Failure to initialize security context [Caused by GSSException: Invalid name provided (Mechanism level: KrbException: Cannot locate default realm)]

at com.sun.security.sasl.gsskerb.GssKrb5Client.<init>(Unknown Source)

at com.sun.security.sasl.gsskerb.FactoryImpl.createSaslClient(Unknown Source)

at javax.security.sasl.Sasl.createSaslClient(Unknown Source)

at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator$1.run(SaslClientAuthenticator.java:151)

at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator$1.run(SaslClientAuthenticator.java:146)

at java.security.AccessController.doPrivileged(Native Method)

at javax.security.auth.Subject.doAs(Unknown Source)

at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.createSaslClient(SaslClientAuthenticator.java:146)

at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.<init>(SaslClientAuthenticator.java:138)

at org.apache.kafka.common.network.SaslChannelBuilder.buildClientAuthenticator(SaslChannelBuilder.java:248)

at org.apache.kafka.common.network.SaslChannelBuilder.buildChannel(SaslChannelBuilder.java:196)

at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:287)

at org.apache.kafka.common.network.Selector.registerChannel(Selector.java:280)

at org.apache.kafka.common.network.Selector.connect(Selector.java:215)

at org.apache.kafka.clients.NetworkClient.initiateConnect(NetworkClient.java:864)

at org.apache.kafka.clients.NetworkClient.ready(NetworkClient.java:265)

at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.sendEligibleCalls(KafkaAdminClient.java:889)

at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1104)

at java.lang.Thread.run(Unknown Source)

Caused by: GSSException: Invalid name provided (Mechanism level: KrbException: Cannot locate default realm)

at sun.security.jgss.krb5.Krb5NameElement.getInstance(Unknown Source)

at sun.security.jgss.krb5.Krb5MechFactory.getNameElement(Unknown Source)

at sun.security.jgss.GSSManagerImpl.getNameElement(Unknown Source)

at sun.security.jgss.GSSNameImpl.getElement(Unknown Source)

at sun.security.jgss.GSSNameImpl.init(Unknown Source)

at sun.security.jgss.GSSNameImpl.<init>(Unknown Source)

at sun.security.jgss.GSSManagerImpl.createName(Unknown Source)

... 19 more

So I've tried to copy my krb5.conf file from my kafka server and put it on my Windows server with JVM option : -Djava.security.krb5.conf=krb5.conf

But still have the same issue.

Does anybody already do this ?

I have also added these config on the JVM : 

-DJvmOptions=-Dsun.security.krb5.debug=true ^

-Djava.security.debug=gssloginconfig,configfile,configparser,logincontext

But they don't provide more info.

For information I am able to run a consule-consumer/producer on my linux kafka server with Keberos credential.

Best regards,

Olivier

[Olivier Norture]

I've found that it works if I use the Kafka's SPN account (kafka/ho...@EXAMPLE.COM), but I don't want to deploy my kafka keytab on all producer.

I don't want to create and manage a couple of SPN, I prefer to use dedicated AD account.

Is there a way to force authentification to not use SPN but just AD account ? Like us...@EXAMPLE.COM ?