Versions Compared

Old Version 2

changes.mady.by.user Jonathan Skrzypek

Saved on

compared with

New Version 3

changes.mady.by.user Jonathan Skrzypek

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

When specifying a dns alias in bootstrap.server, the Java client API doesn't resolve all the CNAMES behind it.

This breaks kerberos based SASL authentication and therefore clients are unable to connect to a secured cluster when using an alias.
The details are specified in the JIRA, but it boils down to the kafka server principal not matching the hostname referenced by the client, as the SaslAuthenticator will compare the alias' FQDN with the kafka broker hostname.

...