Kafka Broker SASL_SSL PLAIN认证失败：用户名或密码无效排查

环境配置 #

Docker Compose配置 #

services:
  zookeeper:
    image: confluentinc/cp-zookeeper:7.4.4
    container_name: zookeeper
    ports:
      - "2181:2181"
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
      KAFKA_OPTS: "-Djava.security.auth.login.config=/etc/zookeeper/zookeeper_jaas.conf"
      ZOOKEEPER_AUTH_PROVIDER_1: org.apache.zookeeper.server.auth.SASLAuthenticationProvider
    volumes:
      - ./secrets:/etc/kafka/secrets:ro
      - ./secrets/zookeeper_jaas.conf:/etc/zookeeper/zookeeper_jaas.conf:ro
    networks:
      - kafka_network


  kafka:
    image: confluentinc/cp-kafka:7.4.4
    user: "0"
    container_name: kafka
    ports:
      - "9092:9092"
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_LISTENERS: SASL_SSL://kafka:9093
      KAFKA_ADVERTISED_LISTENERS: SASL_SSL://kafka:9093
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SASL_SSL:SASL_SSL
      KAFKA_SSL_KEYSTORE_FILENAME: kafka.keystore.jks
      KAFKA_SSL_KEYSTORE_CREDENTIALS: keystore_creds
      KAFKA_SSL_KEY_CREDENTIALS: key_creds
      KAFKA_SSL_TRUSTSTORE_FILENAME: kafka.truststore.jks
      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: truststore_creds
      KAFKA_SSL_CLIENT_AUTH: required
      KAFKA_SASL_ENABLED_MECHANISMS: PLAIN
      KAFKA_SASL_MECHANISMS: PLAIN
      KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN
      KAFKA_SECURITY_PROTOCOL: SASL_SSL
      KAFKA_AUTHORIZER_CLASS_NAME: "kafka.security.authorizer.AclAuthorizer"
      KAFKA_SUPER_USERS: "User:admin"
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
      CONFLUENT_SUPPORT_METRICS_ENABLE: 'false'
      KAFKA_OPTS: "-Djava.security.auth.login.config=/etc/kafka/secrets/kafka_server_jaas.conf"
      KAFKA_INTER_BROKER_LISTENER_NAME: SASL_SSL
      KAFKA_HOST_NAME: kafka

    volumes:
      - ./secrets:/etc/kafka/secrets:ro
    depends_on:
      - zookeeper
    networks:
      - kafka_network

networks:
  kafka_network:
    driver: bridge

JAAS配置文件 #

zookeeper_jaas.conf

Server {
  org.apache.zookeeper.server.auth.DigestLoginModule required
  username="admin"
  password="admin_password"
  user_admin="admin_password";
};

Client {
  org.apache.zookeeper.server.auth.DigestLoginModule required
  username="admin"
  password="admin_password";
};

kafka_server_jaas.conf

KafkaServer {
  org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin_password";
};

Client {
  org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin_password";
};

错误日志 #

ERROR [Controller id=1, targetBrokerId=1] Connection to node 1 (kafka/192.168.160.3:9093) failed authentication due to: Authentication failed: Invalid username or password (org.apache.kafka.clients.NetworkClient)
[2025-01-17 13:45:50,896] WARN [RequestSendThread controllerId=1] Controller 1's connection to broker kafka:9093 (id: 1 rack: null) was unsuccessful (kafka.controller.RequestSendThread)
org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed: Invalid username or password
[2025-01-17 13:45:50,896] INFO [Controller id=1, targetBrokerId=1] Client requested connection close from node 1 (org.apache.kafka.clients.NetworkClient)

原因与解决方法 #

问题原因 #

Kafka的PlainLoginModule配置缺少合法用户列表定义：当前kafka_server_jaas.conf的KafkaServer段仅设置了username和password（用于Broker自身作为客户端的身份标识），但未通过user_<username>格式定义允许连接的用户。没有该定义时，Broker无法验证任何客户端（包括自身控制器组件）的身份，导致认证失败。

解决步骤 #

1. 修改kafka_server_jaas.conf的KafkaServer段，添加合法用户定义：

KafkaServer {
  org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin_password"
  user_admin="admin_password";
};

Client {
  org.apache.kafka.common.security.plain.PlainLoginModule required
  username="admin"
  password="admin_password";
};

其中user_admin="admin_password"是核心，明确了Broker服务端可接受的admin用户及其密码。

2. 验证配置一致性：

• 确保KAFKA_SUPER_USERS配置的User:admin与JAAS中定义的用户名完全一致
• 检查./secrets目录下的SSL证书文件（kafka.keystore.jks、kafka.truststore.jks）及凭证文件（keystore_creds、key_creds、truststore_creds）是否存在且内容正确
• 重启Kafka容器，使新配置生效

内容的提问来源于stack exchange，提问作者Luke