Blizzard / Blizzard/node-rdkafka

Denied Operation is getting triggered in node-rdkafka with incorrect principal

Open
#1,066 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
2.2k
Forks
403
PR merge metrics
No merged PRs in 30d

Description

**Environment Information**
- OS : Linux
- Node Version: 14.21.3
- node-rdkafka version: 2.10.1

**node-rdkafka Configuration Settings**

{

"producerConfig": {
"bootstrap.servers": "MY_BROKER_DETAILS",
"client.id": "localhost",
"debug": "consumer,cgrp,fetch,msg,eos",
"event_cb": true,
"message.max.bytes": 1048576,
"max.in.flight.requests.per.connection": 1,
"sasl.mechanism": "GSSAPI",
"sasl.kerberos.principal": "KAFKA_PRINCIPAL_ID",
"sasl.kerberos.service.name": "kafka",
"sasl.kerberos.keytab": "MY_KRB_KEYTAB",
"sasl.kerberos.kinit.cmd": "kinit -V -R -t \"%{sasl.kerberos.keytab}\" -k %{sasl.kerberos.principal} || kinit -V -t \"%{sasl.kerberos.keytab}\" -k %{sasl.kerberos.principal}",
"sasl.kerberos.min.time.before.relogin": 90000,
"security.protocol": "sasl_plaintext",
"compression.codec": "lz4",
"delivery.timeout.ms": 2147483647,
"dr_msg_cb": true,
"enable.idempotence": false,
"linger.ms": 100,
"message.send.max.retries": 3,
"request.timeout.ms": 180000,
"retry.backoff.ms": 200
},
"topicConfig": {
"acks": -1,
"compression.type": "lz4"
}
}

**Additional context**
Node API is having kafka producer settings with KAFKA_PRINCIPAL_ID. Same machine we are running kinit command with different CACHE_PRINCIPAL_ID to get krb token for different purpose.

When we publish a message to topic it is getting published successfully using the above configuration, but some time it is trying to publish using the CACHE_PRINCIPAL_ID instead of KAFKA_PRINCIPAL_ID and it is getting denied.

I appreciate any help one this.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Node API producer configuration on Linux while comparing the configured KAFKA_PRINCIPAL_ID with the CACHE_PRINCIPAL_ID produced by the separate kinit command. Inspect the Kafka producer settings and kinit command together, then determine why publishing sometimes uses the cache principal; done means the cause is identified and publishing consistently uses the intended principal.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, kafka, node.js
Domain
authentication, backend, distributed-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.