Kafka配置SASL_SSL启动失败：JAAS相关报错求助

Let’s walk through fixing each of your startup errors one by one—you’ve got the core setup in place, just a few critical tweaks to get things running.

1. Fix: "Cannot find kafka_server_jaas.conf" (Shell Script) #

The most common culprit here is relying on a relative path instead of an absolute path for your JAAS file. Kafka’s startup script might not run from the directory you expect, so relative paths can easily break.

Solution: #

Update your export command to use the full absolute path to your JAAS file, and confirm the Kafka process has read permissions for it:

export KAFKA_OPTS="-Djava.security.auth.login.config=/opt/kafka/config/kafka_server_jaas.conf"
# Replace /opt/kafka with your actual Kafka installation directory

Then launch the broker as usual:

bin/kafka-server-start.sh config/server.properties

2. Fix: "No 'KafkaServer' or 'sasl_plaintext.KafkaServer' entry in JAAS config" (Batch Script) #

This error means your kafka_server_jaas.conf is missing the required KafkaServer section that Kafka uses to authenticate itself. Since you’re using SCRAM-SHA-512, your JAAS config needs to explicitly define this section with the correct ScramLoginModule.

Correct JAAS Config Example: #

KafkaServer {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="admin"
    password="your-scram-admin-password"; # Use the actual password you set for the admin user
};

• Double-check the section name: it must be exactly KafkaServer (case-sensitive).
• Ensure you’re using the ScramLoginModule (not PlainLoginModule, which is for SASL_PLAIN).

3. Fix: Path-Related Errors in Windows Batch Script #

Windows has stricter path handling—here’s how to avoid common pitfalls:

Correct Batch Script Setup: #

• Use absolute paths with escaped backslashes (\\) or forward slashes (/), and wrap paths in quotes if there are spaces:

set KAFKA_OPTS="-Djava.security.auth.login.config=C:\kafka\config\kafka_server_jaas.conf"
# Or with forward slashes (often more reliable):
# set KAFKA_OPTS="-Djava.security.auth.login.config=C:/kafka/config/kafka_server_jaas.conf"

• Run the startup script with an absolute path to server.properties if needed:

bin\windows\kafka-server-start.bat C:\kafka\config\server.properties

Additional Server.properties Checks #

Make sure these key settings align with your setup:

• Listeners and security protocol:

  listeners=SASL_SSL://localhost:9093
  security.inter.broker.protocol=SASL_SSL
  

• SASL mechanisms:

  sasl.enabled.mechanisms=SCRAM-SHA-512
  sasl.mechanism.inter.broker.protocol=SCRAM-SHA-512
  

• SSL certificate paths (use absolute paths here too):

  ssl.keystore.location=C:/kafka/config/keystore/kafka.server.keystore.jks
  ssl.keystore.password=your-keystore-password
  ssl.truststore.location=C:/kafka/config/truststore/kafka.server.truststore.jks
  ssl.truststore.password=your-truststore-password
  

• Super user and ACL settings:

  authorizer.class.name=kafka.security.authorizer.AclAuthorizer
  super.users=User:admin
  allow.everyone.if.no.acl.found=false
  

Final Validation Steps #

1. Double-check your kafka_server_jaas.conf for syntax errors (missing brackets or semicolons are easy to overlook!).
2. Confirm the admin SCRAM user was created correctly with:

   bin/kafka-configs.sh --bootstrap-server localhost:9093 --command-config config/client.properties --alter --add-config 'SCRAM-SHA-512=[password=your-admin-password]' --entity-type users --entity-name admin
   

   (For Windows, use the .bat version in bin/windows.)

Once you’ve applied these fixes, your broker should start without those errors.

内容的提问来源于stack exchange，提问作者Muhammad Faizan Khan