From dev-return-97127-archive-asf-public=cust-asf.ponee.io@kafka.apache.org Tue Aug 14 19:33:05 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id 595B5180654 for ; Tue, 14 Aug 2018 19:33:05 +0200 (CEST) Received: (qmail 22493 invoked by uid 500); 14 Aug 2018 17:33:04 -0000 Mailing-List: contact dev-help@kafka.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@kafka.apache.org Delivered-To: mailing list dev@kafka.apache.org Received: (qmail 22482 invoked by uid 99); 14 Aug 2018 17:33:04 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd4-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 14 Aug 2018 17:33:04 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd4-us-west.apache.org (ASF Mail Server at spamd4-us-west.apache.org) with ESMTP id AED3DC1A1C for ; Tue, 14 Aug 2018 17:33:03 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd4-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -109.501 X-Spam-Level: X-Spam-Status: No, score=-109.501 tagged_above=-999 required=6.31 tests=[ENV_AND_HDR_SPF_MATCH=-0.5, KAM_ASCII_DIVIDERS=0.8, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5, USER_IN_WHITELIST=-100] autolearn=disabled Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd4-us-west.apache.org [10.40.0.11]) (amavisd-new, port 10024) with ESMTP id jP4yngSqLoO3 for ; Tue, 14 Aug 2018 17:33:02 +0000 (UTC) Received: from mailrelay1-us-west.apache.org (mailrelay1-us-west.apache.org [209.188.14.139]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with ESMTP id 5504A5F516 for ; Tue, 14 Aug 2018 17:33:01 +0000 (UTC) Received: from jira-lw-us.apache.org (unknown [207.244.88.139]) by mailrelay1-us-west.apache.org (ASF Mail Server at mailrelay1-us-west.apache.org) with ESMTP id 89747E0177 for ; Tue, 14 Aug 2018 17:33:00 +0000 (UTC) Received: from jira-lw-us.apache.org (localhost [127.0.0.1]) by jira-lw-us.apache.org (ASF Mail Server at jira-lw-us.apache.org) with ESMTP id 4A68323F9C for ; Tue, 14 Aug 2018 17:33:00 +0000 (UTC) Date: Tue, 14 Aug 2018 17:33:00 +0000 (UTC) From: "Rajini Sivaram (JIRA)" To: dev@kafka.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Resolved] (KAFKA-7119) Intermittent test failure with GSSAPI authentication failure MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/KAFKA-7119?page=3Dcom.atlassia= n.jira.plugin.system.issuetabpanels:all-tabpanel ] Rajini Sivaram resolved KAFKA-7119. ----------------------------------- Resolution: Fixed Reviewer: Jun Rao Fix Version/s: 2.1.0 2.0.1 1.1.2 1.0.3 > Intermittent test failure with GSSAPI authentication failure > ------------------------------------------------------------ > > Key: KAFKA-7119 > URL: https://issues.apache.org/jira/browse/KAFKA-7119 > Project: Kafka > Issue Type: Bug > Components: security > Affects Versions: 2.0.0 > Reporter: Rajini Sivaram > Assignee: Rajini Sivaram > Priority: Major > Fix For: 1.0.3, 1.1.2, 2.0.1, 2.1.0 > > > I have seen this failure a couple of times in builds (e.g. [https://build= s.apache.org/job/kafka-pr-jdk10-scala2.12/2412/testReport/junit/kafka.api/S= aslSslAdminClientIntegrationTest/testLogStartOffsetCheckpoint/)] > {quote} > org.apache.kafka.common.errors.SaslAuthenticationException: An error: (ja= va.security.PrivilegedActionException: javax.security.sasl.SaslException: G= SS initiate failed [Caused by GSSException: No valid credentials provided (= Mechanism level: Request is a replay (34) - Request is a replay)]) occurred= when evaluating SASL token received from the Kafka Broker. Kafka Client wi= ll go to AUTHENTICATION_FAILED state. Caused by: javax.security.sasl.SaslEx= ception: GSS initiate failed [Caused by GSSException: No valid credentials = provided (Mechanism level: Request is a replay (34) - Request is a replay)]= at jdk.security.jgss/com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateC= hallenge(GssKrb5Client.java:211) at org.apache.kafka.common.security.authen= ticator.SaslClientAuthenticator$2.run(SaslClientAuthenticator.java:358) at = org.apache.kafka.common.security.authenticator.SaslClientAuthenticator$2.ru= n(SaslClientAuthenticator.java:356) at java.base/java.security.AccessContro= ller.doPrivileged(Native Method) at java.base/javax.security.auth.Subject.d= oAs(Subject.java:423) at org.apache.kafka.common.security.authenticator.Sas= lClientAuthenticator.createSaslToken(SaslClientAuthenticator.java:356) at o= rg.apache.kafka.common.security.authenticator.SaslClientAuthenticator.sendS= aslClientToken(SaslClientAuthenticator.java:268) at org.apache.kafka.common= .security.authenticator.SaslClientAuthenticator.authenticate(SaslClientAuth= enticator.java:205) at org.apache.kafka.common.network.KafkaChannel.prepare= (KafkaChannel.java:127) at org.apache.kafka.common.network.Selector.pollSel= ectionKeys(Selector.java:487) at org.apache.kafka.common.network.Selector.p= oll(Selector.java:425) at org.apache.kafka.clients.NetworkClient.poll(Netwo= rkClient.java:510) at org.apache.kafka.clients.consumer.internals.ConsumerN= etworkClient.poll(ConsumerNetworkClient.java:271) at org.apache.kafka.clien= ts.consumer.internals.ConsumerNetworkClient.poll(ConsumerNetworkClient.java= :242) at org.apache.kafka.clients.consumer.internals.ConsumerNetworkClient.= poll(ConsumerNetworkClient.java:218) at org.apache.kafka.clients.consumer.i= nternals.AbstractCoordinator.ensureCoordinatorReady(AbstractCoordinator.jav= a:231) at org.apache.kafka.clients.consumer.internals.ConsumerCoordinator.p= oll(ConsumerCoordinator.java:314) at org.apache.kafka.clients.consumer.Kafk= aConsumer.updateAssignmentMetadataIfNeeded(KafkaConsumer.java:1218) at org.= apache.kafka.clients.consumer.KafkaConsumer.poll(KafkaConsumer.java:1181) a= t org.apache.kafka.clients.consumer.KafkaConsumer.poll(KafkaConsumer.java:1= 115) at kafka.api.AdminClientIntegrationTest.$anonfun$subscribeAndWaitForAs= signment$2(AdminClientIntegrationTest.scala:980) at kafka.utils.TestUtils$.= waitUntilTrue(TestUtils.scala:781) at kafka.api.AdminClientIntegrationTest.= subscribeAndWaitForAssignment(AdminClientIntegrationTest.scala:979) at kafk= a.api.AdminClientIntegrationTest.testLogStartOffsetCheckpoint(AdminClientIn= tegrationTest.scala:755) at java.base/jdk.internal.reflect.NativeMethodAcce= ssorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMet= hodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.i= nternal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso= rImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:564= ) at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkM= ethod.java:50) at org.junit.internal.runners.model.ReflectiveCallable.run(R= eflectiveCallable.java:12) at org.junit.runners.model.FrameworkMethod.invok= eExplosively(FrameworkMethod.java:47) at org.junit.internal.runners.stateme= nts.InvokeMethod.evaluate(InvokeMethod.java:17) at org.junit.internal.runne= rs.statements.RunBefores.evaluate(RunBefores.java:26) at org.junit.internal= .runners.statements.RunAfters.evaluate(RunAfters.java:27) at org.junit.inte= rnal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.= java:298) at org.junit.internal.runners.statements.FailOnTimeout$CallableSt= atement.call(FailOnTimeout.java:292) at java.base/java.util.concurrent.Futu= reTask.run(FutureTask.java:264) at java.base/java.lang.Thread.run(Thread.ja= va:844) Caused by: GSSException: No valid credentials provided (Mechanism l= evel: Request is a replay (34) - Request is a replay) at java.security.jgss= /sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:771) at= java.security.jgss/sun.security.jgss.GSSContextImpl.initSecContext(GSSCont= extImpl.java:265) at java.security.jgss/sun.security.jgss.GSSContextImpl.in= itSecContext(GSSContextImpl.java:196) at jdk.security.jgss/com.sun.security= .sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192) ... 3= 7 more Caused by: KrbException: Request is a replay (34) - Request is a rep= lay at java.security.jgss/sun.security.krb5.KrbTgsRep.(KrbTgsRep.java= :73) at java.security.jgss/sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.j= ava:251) at java.security.jgss/sun.security.krb5.KrbTgsReq.sendAndGetCreds(= KrbTgsReq.java:262) at java.security.jgss/sun.security.krb5.internal.Creden= tialsUtil.serviceCreds(CredentialsUtil.java:308) at java.security.jgss/sun.= security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.= java:126) at java.security.jgss/sun.security.krb5.Credentials.acquireServic= eCreds(Credentials.java:458) at java.security.jgss/sun.security.jgss.krb5.K= rb5Context.initSecContext(Krb5Context.java:695) ... 40 more Caused by: KrbE= xception: Identifier doesn't match expected value (906) at java.security.jg= ss/sun.security.krb5.internal.KDCRep.init(KDCRep.java:140) at java.security= .jgss/sun.security.krb5.internal.TGSRep.init(TGSRep.java:65) at java.securi= ty.jgss/sun.security.krb5.internal.TGSRep.(TGSRep.java:60) at java.se= curity.jgss/sun.security.krb5.KrbTgsRep.(KrbTgsRep.java:55) > ... 46 more > {quote} > =C2=A0 > =C2=A0 > =C2=A0 -- This message was sent by Atlassian JIRA (v7.6.3#76005)