kafka-ui: Cannot authenticate with SASL_SSL and SCRAM-SHA-512 (comma in password)

Describe the bug I am attempting to authenticate via docker-compose with the following confguration:

version: "3"
services:
  kafka-ui:
    image: provectuslabs/kafka-ui
    container_name: kafka-ui
    ports:
      - 18080:8080
    restart: always
    environment:
      KAFKA_CLUSTERS_0_NAME: test
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:9096
      KAFKA_CLUSTERS_0_ZOOKEEPER: zookeper:2181
      KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SASL_SSL
      KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM: SCRAM-SHA-512
      KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG: 'org.apache.kafka.common.security.scram.ScramLoginModule required username="ABC" password="123";'

However, I get the following errors when running the container:

kafka-ui  | 2022-06-03 21:23:18,329 ERROR [kafka-admin-client-thread | adminclient-1] o.a.k.c.NetworkClient: [AdminClient clientId=adminclient-1] Connection to node -1 (redacted-url.zone:9096) failed authentication due to: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512

My kafka cluster is setup to use SASL/SCRAM. The same configuration works from the kafka CLI and from various other apps hosted on the same machine running in various different languages (go, c#, python).

Set up Run the above docker-compose yaml against a cluster configured for SASL_SSL and SCRAM-SHA-512 authentication

Steps to Reproduce Try the above

Expected behavior I should be able to authenticate with the specified configuration.

Additional context I am also open to the possibility that I am missing some environment variable in my docker-compose.

About this issue

  • Original URL
  • State: open
  • Created 2 years ago
  • Comments: 20 (8 by maintainers)

Most upvoted comments

@vunamphuong17 that’s unrelated, a different error message. Your sasl mechanism is “SCARM…”, there’s a typo.

@KozyrevychYaroslav yep, just tried with KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG: 'org.apache.kafka.common.security.plain.PlainLoginModule required username="admin_" password="admin-secret#*$$";' within kafka-ui-sasl.yaml example, works fine.