KRAFT模式Kafka集群ACL认证报错：Failed to configure SaslClientAuthenticator

我用KRAFT协议搭建了Kafka集群，配置ACL认证时遇到Failed to configure SaslClientAuthenticator错误。

配置信息 #

server.properties #

node.id=1
controller.quorum.voters=1@192.168.1.41:9093,2@192.168.1.42:9093,3@192.168.1.43:9093,4@192.168.1.44:9093
listeners=SASL_PLAINTEXT://:9092,CONTROLLER://:9093
inter.broker.listener.name=SASL_PLAINTEXT
advertised.listeners=SASL_PLAINTEXT://192.168.1.41:9092
controller.listener.names=CONTROLLER
process.roles=broker,controller
sasl.enabled.mechanisms=SCRAM-SHA-512
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-512
authorizer.class.name=org.apache.kafka.metadata.authorizer.StandardAuthorizer
super.users=User:kafkaadmin
allow.everyone.if.no.acl.found=true
listener.security.protocol.map=SASL_PLAINTEXT:SASL_PLAINTEXT,CONTROLLER:SASL_PLAINTEXT

kafka_server_jaas.conf #

KafkaServer {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="kafkaadmin"
    password="kafkaadmin123456"
    serviceName="kafka";
};

报错信息 #

java.io.IOException: Channel could not be created for socket java.nio.channels.SocketChannel[closed]
    at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:352)
    at org.apache.kafka.common.network.Selector.registerChannel(Selector.java:329)
    at org.apache.kafka.common.network.Selector.connect(Selector.java:256)
    at org.apache.kafka.clients.NetworkClient.initiateConnect(NetworkClient.java:1072)
    at org.apache.kafka.clients.NetworkClient.ready(NetworkClient.java:320)
    at org.apache.kafka.server.util.InterBrokerSendThread.sendRequests(InterBrokerSendThread.java:145)
    at org.apache.kafka.server.util.InterBrokerSendThread.pollOnce(InterBrokerSendThread.java:108)
    at org.apache.kafka.server.util.InterBrokerSendThread.doWork(InterBrokerSendThread.java:136)
    at org.apache.kafka.server.util.ShutdownableThread.run(ShutdownableThread.java:135)
Caused by: org.apache.kafka.common.KafkaException: org.apache.kafka.common.errors.SaslAuthenticationException: Failed to configure SaslClientAuthenticator
    at org.apache.kafka.common.network.SaslChannelBuilder.buildChannel(SaslChannelBuilder.java:243)
    at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:340)
    ... 8 more
Caused by: org.apache.kafka.common.errors.SaslAuthenticationException: Failed to configure SaslClientAuthenticator
Caused by: org.apache.kafka.common.KafkaException: Principal could not be determined from Subject, this may be a transient failure due to Kerberos re-login
    at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.firstPrincipal(SaslClientAuthenticator.java:633)
    at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.<init>(SaslClientAuthenticator.java:203)
    at org.apache.kafka.common.network.SaslChannelBuilder.buildClientAuthenticator(SaslChannelBuilder.java:289)
    at org.apache.kafka.common.network.SaslChannelBuilder.lambda$buildChannel$1(SaslChannelBuilder.java:229)
    at org.apache.kafka.common.network.KafkaChannel.<init>(KafkaChannel.java:143)
    at org.apache.kafka.common.network.SaslChannelBuilder.buildChannel(SaslChannelBuilder.java:237)
    at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:340)
    at org.apache.kafka.common.network.Selector.registerChannel(Selector.java:329)
    at org.apache.kafka.common.network.Selector.connect(Selector.java:256)
    at org.apache.kafka.clients.NetworkClient.initiateConnect(NetworkClient.java:1072)
    at org.apache.kafka.clients.NetworkClient.ready(NetworkClient.java:320)
    at org.apache.kafka.server.util.InterBrokerSendThread.sendRequests(InterBrokerSendThread.java:145)
    at org.apache.kafka.server.util.InterBrokerSendThread.pollOnce(InterBrokerSendThread.java:108)
    at org.apache.kafka.server.util.InterBrokerSendThread.doWork(InterBrokerSendThread.java:136)
    at org.apache.kafka.server.util.ShutdownableThread.run(ShutdownableThread.java:135)

1. 创建SCRAM认证用户 #

SCRAM-SHA-512要求先在集群中注册用户，否则Broker无法识别该主体。在任意Broker节点执行以下命令：

kafka-configs.sh --bootstrap-server 192.168.1.41:9092 --alter --add-config 'SCRAM-SHA-512=[password=kafkaadmin123456]' --entity-type users --entity-name kafkaadmin

执行完成后重启所有Broker节点。

2. 完善JAAS配置 #

当前JAAS仅配置了KafkaServer模块，但CONTROLLER监听器也启用了SASL认证，需添加Controller模块。修改后的kafka_server_jaas.conf：

KafkaServer {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="kafkaadmin"
    password="kafkaadmin123456"
    serviceName="kafka";
};

Controller {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="kafkaadmin"
    password="kafkaadmin123456"
    serviceName="kafka";
};

3. 确保JAAS配置正确加载 #

启动Kafka前，通过JVM参数指定JAAS配置文件路径：

export KAFKA_OPTS="-Djava.security.auth.login.config=/实际路径/kafka_server_jaas.conf"

替换/实际路径/为配置文件所在的真实路径，再启动Kafka服务。

4. 检查集群配置一致性 #

所有Broker节点的server.properties和kafka_server_jaas.conf必须完全一致，包括节点ID、控制器投票列表、监听器配置、认证参数等，避免因配置差异导致的通信失败。

内容的提问来源于stack exchange，提问作者huangcy