Blizzard / Blizzard/node-rdkafka
Denied Operation is getting triggered in node-rdkafka with incorrect principal
- Dominant language
- JavaScript
- Stars
- 2.2k
- Forks
- 403
- PR merge metrics
- No merged PRs in 30d
Description
**Environment Information**
- OS : Linux
- Node Version: 14.21.3
- node-rdkafka version: 2.10.1
**node-rdkafka Configuration Settings**
{
"producerConfig": {
"bootstrap.servers": "MY_BROKER_DETAILS",
"client.id": "localhost",
"debug": "consumer,cgrp,fetch,msg,eos",
"event_cb": true,
"message.max.bytes": 1048576,
"max.in.flight.requests.per.connection": 1,
"sasl.mechanism": "GSSAPI",
"sasl.kerberos.principal": "KAFKA_PRINCIPAL_ID",
"sasl.kerberos.service.name": "kafka",
"sasl.kerberos.keytab": "MY_KRB_KEYTAB",
"sasl.kerberos.kinit.cmd": "kinit -V -R -t \"%{sasl.kerberos.keytab}\" -k %{sasl.kerberos.principal} || kinit -V -t \"%{sasl.kerberos.keytab}\" -k %{sasl.kerberos.principal}",
"sasl.kerberos.min.time.before.relogin": 90000,
"security.protocol": "sasl_plaintext",
"compression.codec": "lz4",
"delivery.timeout.ms": 2147483647,
"dr_msg_cb": true,
"enable.idempotence": false,
"linger.ms": 100,
"message.send.max.retries": 3,
"request.timeout.ms": 180000,
"retry.backoff.ms": 200
},
"topicConfig": {
"acks": -1,
"compression.type": "lz4"
}
}
**Additional context**
Node API is having kafka producer settings with KAFKA_PRINCIPAL_ID. Same machine we are running kinit command with different CACHE_PRINCIPAL_ID to get krb token for different purpose.
When we publish a message to topic it is getting published successfully using the above configuration, but some time it is trying to publish using the CACHE_PRINCIPAL_ID instead of KAFKA_PRINCIPAL_ID and it is getting denied.
I appreciate any help one this.
Contributor guide
Research direction
Start by reproducing the Node API producer configuration on Linux while comparing the configured KAFKA_PRINCIPAL_ID with the CACHE_PRINCIPAL_ID produced by the separate kinit command. Inspect the Kafka producer settings and kinit command together, then determine why publishing sometimes uses the cache principal; done means the cause is identified and publishing consistently uses the intended principal.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, kafka, node.js
- Domain
- authentication, backend, distributed-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100