Problem connecting to Kafka with Kerberos and TLS

[dzbeda]

Hi ,
I have Kafka that is Kerborized and with TLS.
I have set the configuration - but i think that I'm missing the krb5.conf. - If so how can I upload it and enable the use of it

I have used the following compose file

---

version: '3.4'
services:
kafka-ui:
container_name: kafka-ui
image: provectuslabs/kafka-ui:latest
ports:
- 8080:8080

extra_hosts:
  - "kafka1.lab.com:10.1.1.1"
environment:
  KAFKA_CLUSTERS_0_NAME: lab
  KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SASL_SSL
  KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM: GSSAPI
  KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG: com.sun.security.auth.module.Krb5LoginModule required  useTicketCache=true useKeyTab=true storeKey=true keyTab="/tmp/systemuser.keytab" principal="[email protected]";
  KAFKA_CLUSTERS_0_PROPERTIES_SASL_KERBEROS_SERVICE_NAME: "kafka"
  KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka1.lab.com:9093
  KAFKA_CLUSTERS_0_SSL_TRUSTSTORELOCATION: /tmp/truststore
  KAFKA_CLUSTERS_0_SSL_TRUSTSTOREPASSWORD: pass
  KAFKA_CLUSTERS_0_PROPERTIES_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: '' # DISABLE COMMON NAME VERIFICATION
  DYNAMIC_CONFIG_ENABLED: true
volumes:
  - ./nifi.truststore:/tmp/truststore:U
  - ./system1.keytab:/tmp/systemuser.keytab:U
  - ./krb5.conf:/etc/krb5.conf:U

And i'm getting the following error

Caused by: javax.security.auth.login.LoginException: Could not login: the client is being asked for a password, but the Kafka client code does not currently support obtaining a password from the user. not available to garner authentication information from the user
kafka-ui | at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.promptForPass(Krb5LoginModule.java:925)
kafka-ui | at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:745)
kafka-ui | at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:597)
kafka-ui | at java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:755)
kafka-ui | at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:679)
kafka-ui | at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:677)
kafka-ui | at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
kafka-ui | at java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:677)
kafka-ui | at java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:587)
kafka-ui | at org.apache.kafka.common.security.authenticator.AbstractLogin.login(AbstractLogin.java:60)
kafka-ui | at org.apache.kafka.common.security.kerberos.KerberosLogin.login(KerberosLogin.java:103)
kafka-ui | at org.apache.kafka.common.security.authenticator.LoginManager.(LoginManager.java:62)
kafka-ui | at org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:105)
kafka-ui | at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:170)

[Haarolean]

Hi,
please take a look at this: #2118 (comment)
we can't fix this without a reproducible scenario