[KAFKA-4764] Improve diagnostics for SASL authentication failures

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.10.2.0
• Fix Version/s: 1.0.0
• Component/s: security
• Assignee: Rajini Sivaram
• Reporter: Rajini Sivaram
• Created: 14/Feb/17 12:42
• Updated: 04/Oct/17 14:27
• Resolved: 15/Sep/17 16:17

Description

At the moment, broker closes the client connection if SASL authentication fails. Clients see this as a connection failure and do not get any feedback for the reason why the connection was closed. Producers and consumers retry, attempting to create successful connections, treating authentication failures as transient failures. There are no log entries on the client-side which indicate that any of these connection failures were due to authentication failure.

This JIRA will aim to improve diagnosis of authentication failures with the changes described in KIP-152.

This JIRA also does not change handling of SSL authentication failures. javax.net.debug provides sufficient diagnostics for this case. SSL changes are harder to do while preserving backward compatibility.

Issue Links

• blocks: KAFKA-5854 Handle SASL authentication failures as non-retriable exceptions in clients
• duplicates: KAFKA-5910 Kafka 0.11.0.1 Kafka consumer/producers retries in infinite loop when wrong SASL creds are passed
• duplicates: KAFKA-5015 SASL/SCRAM authentication failures are hidden
• links to: GitHub Pull Request #2546
• links to: GitHub Pull Request #3708
• links to: GitHub Pull Request #4013
• mentioned in: Page Loading...

Sub-Tasks

• Log connection termination during authentication: Resolved