IT40485: SASL.JAAS.CONFIG PROPERTY MAY NOT WORK FOR KAFKA NODES.

APAR status

• Closed as program error.

Error description

• A user can specify the authentication login module through
  sasl.jaas.config Kafka client property. It can be configured
  through an external properties file or by using a Kafka policy.
  However, all the values of sasl.jaas.config may not take effect
  and the user will see the Kafka nodes failing to connect to the
  Kafka server.
  
  In the reported case, the customer was trying to connect to an
  Amazon MSK server protected with IAM policy and they were using
  the following properties file on the KafkaConsumer node.
  .
  ssl.truststore.location=<PATH_TO_TRUST_STORE_FILE>
  security.protocol=SASL_SSL
  sasl.mechanism=AWS_MSK_IAM
  sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule
  required;
  sasl.client.callback.handler.class=software.amazon.msk.auth.iam
  .IAMClientCallbackHandler
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of IBM App Connect Enterprise V12.0 and V11.0 using
  sasl.jaas.config property with Kafka nodes.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  A user can specify the authentication login module through
  sasl.jaas.config Kafka client property. It can be configured
  through an external properties file or by using the SASL Config
  property of a Kafka policy. However, the value of
  sasl.jaas.config may not take effect and the user will see the
  Kafka nodes failing to connect to the Kafka server.
  
  In the reported case, the customer was trying to connect to an
  Amazon MSK server protected with IAM policy and they were using
  an external properties file on the KafkaConsumer node that
  contains the following values.
  
  ssl.truststore.location=<PATH_TO_TRUST_STORE_FILE>
  security.protocol=SASL_SSL
  sasl.mechanism=AWS_MSK_IAM
  sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule
  required;
  sasl.client.callback.handler.class=software.amazon.msk.auth.iam.
  IAMClientCallbackHandler
  

Problem conclusion

• sasl.jaas.config property value is honored as-is by the Kafka
  nodes if a custom value is set.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v11.0      11.0.0.18
  v12.0      12.0.5.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0550

Applicable component levels