superuser cannot login suddenly

[runkecheng]

    kafka:
      authorization:
        superUsers:
        - kafka-xxx-admin
        type: simple

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: kafka-xxx-admin
spec:
  authentication:
    password:
      valueFrom:
        secretKeyRef:
          key: password
          name: kafka-xxx-admin
    type: scram-sha-512
  authorization:
    acls: []
    type: simple

I have a superuser that was available when I created the cluster, and after running it for a while, it suddenly became unavailable and scram reported the following error:

kafka: client has run out of available brokers to talk to: EOF

Is there a way to get the real passwords stored in the cluster? I haven't changed the password and the status of kafkauser is ready.

[scholzj]

This does not look like a password issue but more like some connectivity or Kafka cluster issue.

[runkecheng]

Thank you very much for your reply.

The server side reports the following error:

Failing SASL authentication due to invalid receive size

I tried to create a new normal user using kafkauser and it works fine.

I don't know what mechanism is used to store the password of superuser in kafka.
Is it possible to provide some directions and suggestions for troubleshooting? It doesn't look like there are any other exception logs in zk or kafka.

[scholzj]

invalid receive size normally suggests some kind of client misconfiguration as the client sends something what the server doesn't expect. You did not shared your config, so it is hard to say. It could like disabled TLS when it should be enabled or the other way around, misconfigured SASL mechanism etc. This would still not indicate any password issue. Also, if you fail the authentication, it doesn't matter at all whether you are a super user or not. The super user concept is only abotu auhtorization that happens after authentication.

[runkecheng]

sasl.properties

security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required
username="kafka-xxx-admin"
password="G1yQWSLekF3OiBLyjxzCvz>^owfQJPOd15LYFMTknndH8J08c1thSy<ADiQekx\6";

./bin/kafka-acls.sh --bootstrap-server <address> --command-config sasl.properties --list
...
failed authentication due to invalid credentials with SASL mechanism
...

There are some differences in error reporting between using the command line and scram

[scholzj]

The sas.jaas.config needs ot be one line. Not sure if this is just a copy-paste issue or misconfiguration. It can be also sensitive to some special characters. So you should try to avoid them maybe to check if those can be an issue?