[KAFKA-12730] A single Kerberos login failure fails all future connections from Java 9 onwards

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.5.2, 2.6.3, 2.7.2, 2.8.1, 3.0.0
• Component/s: security
• Assignee: Rajini Sivaram
• Reporter: Rajini Sivaram
• Reviewer: Manikumar
• Created: 29/Apr/21 08:22
• Updated: 05/May/21 15:39
• Resolved: 29/Apr/21 14:45

Description

The refresh thread for Kerberos performs re-login by logging out and then logging in again. If login fails, we retry after a backoff. Every iteration of the loop performs loginContext.logout() and loginContext.login(). If login fails, we end up with two consecutive logouts. This used to work, but from Java 9 onwards, this results in a NullPointerException due to https://bugs.openjdk.java.net/browse/JDK-8173069. We should check if logout is required before attempting logout.

Issue Links

• links to: GitHub Pull Request #10611