Can not connect with SASL_PLAINTEX and GSSAPI

[gm9794]

I am trying to connect to Kafka in a Kerberized cluster. Java applications work fine, but using Python I came across an connection/authentication issue.
Environment:

• Kafka 0.10.0.2.6
• Kerberos 5 version 1.12.2 (MS AD server)
• Python 3.6.1 |Anaconda 4.4.0 (64-bit)
• kafka-python (1.3.6.dev0)
• gssapi (1.2.2)

>>> consumer = KafkaConsumer('test1'
...                          ,bootstrap_servers=['kafka1-lab.company.com:6667']
...                          ,api_version=(0,10,0)
...                          ,group_id='python_client'
...                          ,security_protocol='SASL_PLAINTEXT'
...                          ,sasl_mechanism='GSSAPI')
DEBUG:kafka.metrics.metrics:Added sensor with name connections-closed
DEBUG:kafka.metrics.metrics:Added sensor with name connections-created
DEBUG:kafka.metrics.metrics:Added sensor with name select-time
DEBUG:kafka.metrics.metrics:Added sensor with name io-time
INFO:kafka.client:Bootstrapping cluster metadata from [('kafka1-lab.company.com', 6667, <AddressFamily.AF_UNSPEC: 0>)]
DEBUG:kafka.client:Attempting to bootstrap via node at kafka1-lab.company.com:6667
DEBUG:kafka.metrics.metrics:Added sensor with name bytes-sent-received
DEBUG:kafka.metrics.metrics:Added sensor with name bytes-sent
DEBUG:kafka.metrics.metrics:Added sensor with name bytes-received
DEBUG:kafka.metrics.metrics:Added sensor with name request-latency
DEBUG:kafka.metrics.metrics:Added sensor with name node-bootstrap.bytes-sent
DEBUG:kafka.metrics.metrics:Added sensor with name node-bootstrap.bytes-received
DEBUG:kafka.metrics.metrics:Added sensor with name node-bootstrap.latency
DEBUG:kafka.conn:<BrokerConnection node_id=bootstrap host=kafka1-lab.company.com/kafka1-lab.company.com port=6667>: creating new socket
DEBUG:kafka.conn:<BrokerConnection node_id=bootstrap host=kafka1-lab.company.com/10.24.28.27 port=6667>: setting socket option (6, 1, 1)
INFO:kafka.conn:<BrokerConnection node_id=bootstrap host=kafka1-lab.company.com/10.24.28.27 port=6667>: connecting to 10.24.28.27:6667
DEBUG:kafka.conn:<BrokerConnection node_id=bootstrap host=kafka1-lab.company.com/10.24.28.27 port=6667>: established TCP connection
DEBUG:kafka.conn:<BrokerConnection node_id=bootstrap host=kafka1-lab.company.com/10.24.28.27 port=6667>: initiating SASL authentication
DEBUG:kafka.protocol.parser:Sending request SaslHandShakeRequest_v0(mechanism='GSSAPI')
DEBUG:kafka.conn:<BrokerConnection node_id=bootstrap host=kafka1-lab.company.com/10.24.28.27 port=6667> Request 1: SaslHandShakeRequest_v0(mechanism='GSSAPI')
DEBUG:kafka.protocol.parser:Received correlation id: 1
DEBUG:kafka.protocol.parser:Processing response SaslHandShakeResponse_v0

At this step the program hangs.

Any idea what is wrong and how to fix the issue ?
Or how to debug it ?

Thanks

[dpkp]

do you know what commit specifically you are on w/ 1.3.6.dev0 ?

[gm9794]

It is just a clone of actual master branch. I tried earlier the release 1.3.5, it also did not work.

[qkiss]

Same here. GSSAPI response is received, but the _handle_sasl_handshake_response callback for sasl_response is not executed to process this response.

[dpkp]

If you can reproduce locally, perhaps you can try running pdb to find the issue. Otherwise I cannot reproduce.

[natedogs911]

Hello,

Slightly different log but i'm having the same issue,
using commit cfddc6b
which should be the latest.

producer code:
producer = KafkaProducer(bootstrap_servers = [bs],security_protocol='SASL_PLAINTEXT', sasl_mechanism = 'GSSAPI', api_version_auto_timeout_ms=3600000)

Added sensor with name connections-closed
Added sensor with name connections-created
Added sensor with name select-time
Added sensor with name io-time
Bootstrapping cluster metadata from [('some.server.somewhere', 9092, 0)]
Attempting to bootstrap via node at some.server.somewhere:9092
Added sensor with name bytes-sent-received
Added sensor with name bytes-sent
Added sensor with name bytes-received
Added sensor with name request-latency
Added sensor with name node-bootstrap.bytes-sent
Added sensor with name node-bootstrap.bytes-received
Added sensor with name node-bootstrap.latency
<BrokerConnection node_id=bootstrap host=some.server.somewhere/some.server.somewhere port=9092>: creating new socket
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: setting socket option (6, 1, 1)
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: connecting to 10.0.0.1:9092
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: established TCP connection
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: initiating SASL authentication
Sending request SaslHandShakeRequest_v0(mechanism='GSSAPI')
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092> Request 1: SaslHandShakeRequest_v0(mechanism='GSSAPI')
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: socket disconnected
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: Closing connection. ConnectionError: socket disconnected
<BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: reconnect backoff 0.0558228900555 after 1 failures
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/site-packages/kafka/producer/kafka.py", line 349, in __init__
    **self.config)
  File "/usr/lib/python2.7/site-packages/kafka/client_async.py", line 216, in __init__
    self._bootstrap(collect_hosts(self.config['bootstrap_servers']))
  File "/usr/lib/python2.7/site-packages/kafka/client_async.py", line 250, in _bootstrap
    bootstrap.connect()
  File "/usr/lib/python2.7/site-packages/kafka/conn.py", line 372, in connect
    if self._try_authenticate():
  File "/usr/lib/python2.7/site-packages/kafka/conn.py", line 447, in _try_authenticate
    if self._sasl_auth_future.failed():
AttributeError: 'NoneType' object has no attribute 'failed'

[dpkp]

Thanks. I think I understand the root cause. Will work on a PR.

…

On Oct 13, 2017 11:25 PM, "Nathanael Smith" ***@***.***> wrote: Hello, Slightly different log but i'm having the same issue, using commit cfddc6b <cfddc6b> which should be the latest. producer code: producer = KafkaProducer(bootstrap_servers = [bs],security_protocol='SASL_PLAINTEXT', sasl_mechanism = 'GSSAPI', api_version_auto_timeout_ms=3600000) Added sensor with name connections-closed Added sensor with name connections-created Added sensor with name select-time Added sensor with name io-time Bootstrapping cluster metadata from [('some.server.somewhere', 9092, 0)] Attempting to bootstrap via node at some.server.somewhere:9092 Added sensor with name bytes-sent-received Added sensor with name bytes-sent Added sensor with name bytes-received Added sensor with name request-latency Added sensor with name node-bootstrap.bytes-sent Added sensor with name node-bootstrap.bytes-received Added sensor with name node-bootstrap.latency <BrokerConnection node_id=bootstrap host=some.server.somewhere/some.server.somewhere port=9092>: creating new socket <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: setting socket option (6, 1, 1) <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: connecting to 10.0.0.1:9092 <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: established TCP connection <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: initiating SASL authentication Sending request SaslHandShakeRequest_v0(mechanism='GSSAPI') <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092> Request 1: SaslHandShakeRequest_v0(mechanism='GSSAPI') <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: socket disconnected <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: Closing connection. ConnectionError: socket disconnected <BrokerConnection node_id=bootstrap host=some.server.somewhere/10.0.0.1 port=9092>: reconnect backoff 0.0558228900555 after 1 failures Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.7/site-packages/kafka/producer/kafka.py", line 349, in __init__ **self.config) File "/usr/lib/python2.7/site-packages/kafka/client_async.py", line 216, in __init__ self._bootstrap(collect_hosts(self.config['bootstrap_servers'])) File "/usr/lib/python2.7/site-packages/kafka/client_async.py", line 250, in _bootstrap bootstrap.connect() File "/usr/lib/python2.7/site-packages/kafka/conn.py", line 372, in connect if self._try_authenticate(): File "/usr/lib/python2.7/site-packages/kafka/conn.py", line 447, in _try_authenticate if self._sasl_auth_future.failed(): AttributeError: 'NoneType' object has no attribute 'failed' — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1255 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAzetF_1ggyRUMjUjDq9AF0-yrT6QOeGks5ssFPVgaJpZM4P3W4Y> .

[dpkp]

Please test against master and reopen if problem persists.