Spring Cloud Stream 忽略SASL认证配置问题求助

问题 #

开发的微服务从Kafka主题消费消息并生产修改后的消息到另一个主题，未配置认证时运行正常，启用SASL Plaintext认证后，Broker日志出现认证错误，服务启动日志显示认证配置被忽略：

...
    sasl.jaas.config = null
....
    sasl.mechanism = GSSAPI
...
    security.protocol = PLAINTEXT

使用的application.yml配置：

spring.cloud:
  function.definition: stocksProcessor
spring.cloud.stream:
  bindings:
    stocksProcessor-in-0:
      destination: input-stocks
      group: ms-pos-stocks-provider-dev
    stocksProcessor-out-0:
      destination: output-stocks.pretty
  kafka.streams:
    binder.applicationId: ms-pos-stocks-provider
  kafka.binder:
    brokers: kafka-01:19092,kafka-02:29092, kafka-03:39092
    jaas.enabled: true
    configuration.security.protocol: SASL_PLAINTEXT
    configuration.sasl.mechanism: PLAIN
    configuration.sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="password";
  kafka.bindings:
    stocksProcessor-in-0:
      consumer:
        enableDlq: true
        dlqName: dlq-stocks
        configuration:
          value:
            deserializer: org.springframework.kafka.support.serializer.JsonDeserializer
    stocksProcessor-out-0:
      producer:
        compression: lz4
        configuration:
          value:
            serializer: org.springframework.kafka.support.serializer.JsonSerializer

pom.xml依赖片段：

<dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-stream-binder-kafka-streams</artifactId>
            <version>4.0.2</version>
        </dependency>

解决方案 #

问题出在SASL认证配置的层级错误，你使用的是Kafka Streams Binder，认证配置需要放在spring.cloud.stream.kafka.streams.binder节点下，而非通用的kafka.binder节点。修改后的配置如下：

spring.cloud:
  function.definition: stocksProcessor
spring.cloud.stream:
  bindings:
    stocksProcessor-in-0:
      destination: input-stocks
      group: ms-pos-stocks-provider-dev
    stocksProcessor-out-0:
      destination: output-stocks.pretty
  kafka.streams:
    binder:
      applicationId: ms-pos-stocks-provider
      brokers: kafka-01:19092,kafka-02:29092, kafka-03:39092
      jaas.enabled: true
      configuration:
        security.protocol: SASL_PLAINTEXT
        sasl.mechanism: PLAIN
        sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="user" password="password";
  kafka.bindings:
    stocksProcessor-in-0:
      consumer:
        enableDlq: true
        dlqName: dlq-stocks
        configuration:
          value:
            deserializer: org.springframework.kafka.support.serializer.JsonDeserializer
    stocksProcessor-out-0:
      producer:
        compression: lz4
        configuration:
          value:
            serializer: org.springframework.kafka.support.serializer.JsonSerializer

关键修改点 #

• 将原kafka.binder下的所有配置（brokers、jaas、security相关参数）移动到kafka.streams.binder节点内
• 确保kafka.streams.binder.configuration下的SASL参数层级正确，避免配置被客户端忽略

修改后，Kafka Streams客户端会正确加载SASL认证配置，不再使用默认的GSSAPI机制和PLAINTEXT协议。

内容的提问来源于stack exchange，提问作者Alexey Khudyakov