AKHQ基础身份认证失效，登录触发LDAP异常求助

用AKHQ 0.23.0监控Kafka 2.6.0集群，配置里的basic-authentication完全没生效，登录UI时还抛出异常，日志和配置文件如下：

登录异常日志 #

2023-07-28 14:48:00,669 ERROR r-thread-2 o.a.c.ErrorController      Unprocessed Continuation 
Reference(s)
javax.naming.PartialResultException: Unprocessed Continuation Reference(s)
    at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2918)
    at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2892)
    at java.naming/com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1846)
    at java.naming/com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1769)
    at java.naming/com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1786)
    at java.naming/com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:418)
    at java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:396)
    at java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:378)
    at java.naming/javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286)
    at io.micronaut.security.ldap.context.DefaultLdapSearchService.search(DefaultLdapSearchService.java:55)
    at io.micronaut.security.ldap.context.DefaultLdapSearchService.searchFirst(DefaultLdapSearchService.java:40)
    at io.micronaut.security.ldap.LdapAuthenticationProvider.lambda$authenticate$2(LdapAuthenticationProvider.java:111)
    at reactor.core.publisher.FluxCreate.subscribe(FluxCreate.java:95)
    at reactor.core.publisher.InternalFluxOperator.subscribe(InternalFluxOperator.java:62)
    at reactor.core.publisher.FluxSubscribeOn$SubscribeOnSubscriber.run(FluxSubscribeOn.java:194)
    at io.micronaut.reactive.reactor.instrument.ReactorInstrumentation.lambda$init$0(ReactorInstrumentation.java:62)
    at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:84)
    at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:37)
    at io.micrometer.core.instrument.composite.CompositeTimer.recordCallable(CompositeTimer.java:77)
    at io.micrometer.core.instrument.Timer.lambda$wrap$1(Timer.java:162)
    at io.micronaut.scheduling.instrument.InvocationInstrumenterWrappedCallable.call(InvocationInstrumenterWrappedCallable.java:53)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:834)
2023-07-28 14:48:00,675 WARN  r-thread-4 org.akhq.log.access        [Date: 2023-07-28T14:48:] [Duration: 506 ms] [Url: POST /login] [Status: 500] [Ip:] [User: Anonymous]

application-dev.yml配置文件 #

micronaut:
  server:
    port: 8443
    cors:
      enabled: true
      configurations:
        all:
          allowedOrigins:
            - http://localhost:9080
  security:
    enabled: true
    ldap:
      default:
        enabled: true
        context:
          server: 'ldap://**.local:389'
          managerDn: 'cn=**,ou=Service_User,dc=**,dc=local'
          managerPassword: '**'
        search:
          base: "dc=**,dc=local"
        groups:
          enabled: true
          base: "dc=**,dc=local"
akhq:
  connections:
    local:
      properties:
        bootstrap.servers: "localhost:9092"
      schema-registry:
        url: "http://schema-registry:8085"
      connect:
        - name: "connect"
          url: "http://localhost:8083"
  security:
    groups:
      admin: # unique key
        name: admin # Group name
        roles:  # roles for the group
          - topic/read
          - topic/insert
          - topic/delete
          - topic/config/update
          - node/read
          - node/config/update
          - topic/data/read
          - topic/data/insert
          - topic/data/delete
          - group/read
          - group/delete
          - group/offsets/update
          - registry/read
          - registry/insert
          - registry/update
          - registry/delete
          - registry/version/delete
          - acls/read
          - connect/read
          - connect/insert
          - connect/update
          - connect/delete
          - connect/state/update
        attributes:
          # Regexp list to filter topic available for group
          topics-filter-regexp:
            - "test.*"
          # Regexp list to filter connect configs visible for group
          connects-filter-regexp:
            - "^test.*$"
          # Regexp list to filter consumer groups visible for group
          consumer-groups-filter-regexp:
            - "consumer.*"
      topic-reader: # unique key
        name: topic-reader # Other group
        roles:
          - topic/read
        attributes:
          topics-filter-regexp:
            - "test\\.reader.*"
    basic-auth:
      - username: admin
        password: 2548d15a37248ed962ced56f49d4cfe3cf072aee0a2a0483b67abbb2f9c01188
        groups:
          - admin

    ldap:
      default-group: topic-reader
      groups:
        - name: group-ldap-1
          groups: # Akhq groups list
            - topic-reader-dev
        - name: group-ldap-2
          groups:
            - admin

1. 核心问题分析 #

你同时开启了LDAP认证和基础认证，AKHQ默认会优先走LDAP认证流程，直接跳过基础认证。而且你的LDAP配置本身存在问题，日志里的PartialResultException是LDAP搜索时未处理续传引用导致的，这是登录报错的直接原因。

2. 分步修复 #

（1）修复LDAP异常 #

在Micronaut的LDAP配置中添加follow-referrals: false，禁用引用跟随即可解决该异常：

micronaut:
  security:
    ldap:
      default:
        context:
          # 新增以下配置
          follow-referrals: false

（2）让基础认证生效 #

• 如果只想使用基础认证，直接关闭LDAP：

micronaut:
  security:
    ldap:
      default:
        enabled: false

• 如果需要同时启用两种认证，需指定认证顺序，让AKHQ优先尝试基础认证：

micronaut:
  security:
    authentication: basic,ldap
    providers:
      basic:
        enabled: true
      ldap:
        enabled: true

（3）验证密码格式 #

AKHQ基础认证要求密码为SHA-256哈希值，你配置的格式看起来正确，但可以用以下命令重新生成验证，确保与配置一致：

echo -n "你的明文密码" | sha256sum

（4）检查YAML格式 #

确认akhq.security.basic-auth的缩进正确，它必须直接隶属于akhq.security节点，你的配置缩进无误，但建议再核对一遍避免语法错误。

3. 验证 #

修改配置后重启AKHQ服务：

• 使用基础认证的admin账号登录，验证是否能正常进入UI
• 若保留LDAP配置，测试LDAP账号登录是否无PartialResultException异常

内容的提问来源于stack exchange，提问作者Emrahall