No Kerberos credentials available / Server not found in Kerberos database

[kkozak-fessio]

Hi, I need help with connection to SASL / GSSAPI.

• Version of Ruby: 2.6.3p62
• Version of ruby-kafka: 1.2.0
• System: Debian 8/9/10

Example of code:

require "kafka"

# Non-Commercial certificate
OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

logger = Logger.new($stderr)
brokers = ['test-1.fessio.local','test-2.fessio.local','test-3.fessio.local']

kafka = Kafka.new(
    logger: logger,
    seed_brokers: brokers,
    sasl_gssapi_principal: 'fessio@FESSIO',
    sasl_gssapi_keytab: '/home/fessio/fessio.keytab',
    ssl_ca_cert: File.read('fessio_cert.pem'))

kafka.deliver_message('test', topic: 'test')

/etc/krb5.conf

[libdefaults]
         dns_lookup_realm = true
         dns_lookup_kdc = true
         ticket_lifetime = 24h
         renew_lifetime = 7d
         forwardable = true
         rdns =  false
         default_ccache_name = FILE:/tmp/krb5cc_%{uid}
         default_realm = FESSIO
         default_cc_type = FILE
[realms]
        FESSIO = {
                kdc = server01.fessio
                kdc = server02.fessio
                admin_server = server01.fessio
                admin_server = server02.fessio
        }
[domain_realm]
        .fessio = FESSIO
         fessio = FESSIO

Actual outcome

After run code:

I, [2020-08-24T13:10:19.338077 #5554]  INFO -- : New topics added to target list: test
I, [2020-08-24T13:10:19.338244 #5554]  INFO -- : Fetching cluster metadata from kafka://test-1.fessio.local
D, [2020-08-24T13:10:19.338466 #5554] DEBUG -- : [sasl_handshake] Opening connection to test-1.fessio.local with client id ruby-kafka...
D, [2020-08-24T13:10:19.536178 #5554] DEBUG -- : [sasl_handshake] Sending sasl_handshake API request 1 to test-1.fessio.local
D, [2020-08-24T13:10:19.536912 #5554] DEBUG -- : [sasl_handshake] Waiting for response 1 from test-1.fessio.local
D, [2020-08-24T13:10:19.693376 #5554] DEBUG -- : [sasl_handshake] Received response 1 from test-1.fessio.local
D, [2020-08-24T13:10:19.820692 #5554] DEBUG -- : GSSAPI: Initializing context with test-1.fessio.local, principal fessio@FESSIO
Traceback (most recent call last):
        16: from kafka.rb:16:in `<main>'
        15: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/client.rb:165:in `deliver_message'
        14: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:181:in `partitions_for'
        13: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:56:in `add_target_topics'
        12: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:102:in `refresh_metadata!'
        11: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:402:in `cluster_info'
        10: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:422:in `fetch_cluster_info'
         9: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:422:in `each'
         8: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:427:in `block in fetch_cluster_info'
         7: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/broker.rb:44:in `fetch_metadata'
         6: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/broker.rb:200:in `send_request'
         5: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/broker.rb:214:in `connection'
         4: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/connection_builder.rb:27:in `build_connection'
         3: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/sasl_authenticator.rb:58:in `authenticate!'
         2: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/sasl/gssapi.rb:25:in `authenticate!'
         1: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/sasl/gssapi.rb:72:in `initialize_gssapi_context'
/usr/local/rvm/gems/ruby-2.6.3/gems/gssapi-1.3.0/lib/gssapi/simple.rb:96:in `init_context': gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure.  Minor code may provide more information (GSSAPI::GssApiError)
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)

When I manually connect:
kinit -kt ~/fessio.keytab fessio@FESSIO
Return:

I, [2020-08-24T13:28:05.303902 #5759]  INFO -- : New topics added to target list: test
I, [2020-08-24T13:28:05.304078 #5759]  INFO -- : Fetching cluster metadata from kafka://test-1.fessio.local
D, [2020-08-24T13:28:05.304208 #5759] DEBUG -- : [sasl_handshake] Opening connection to test-1.fessio.local with client id ruby-kafka...
D, [2020-08-24T13:28:05.502774 #5759] DEBUG -- : [sasl_handshake] Sending sasl_handshake API request 1 to test-1.fessio.local
D, [2020-08-24T13:28:05.503270 #5759] DEBUG -- : [sasl_handshake] Waiting for response 1 from test-1.fessio.local
D, [2020-08-24T13:28:05.647229 #5759] DEBUG -- : [sasl_handshake] Received response 1 from test-1.fessio.local
D, [2020-08-24T13:28:05.729213 #5759] DEBUG -- : GSSAPI: Initializing context with test-1.fessio.local, principal fessio@FESSIO
Traceback (most recent call last):
        16: from kafka.rb:16:in `<main>'
        15: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/client.rb:165:in `deliver_message'
        14: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:181:in `partitions_for'
        13: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:56:in `add_target_topics'
        12: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:102:in `refresh_metadata!'
        11: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:402:in `cluster_info'
        10: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:422:in `fetch_cluster_info'
         9: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:422:in `each'
         8: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/cluster.rb:427:in `block in fetch_cluster_info'
         7: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/broker.rb:44:in `fetch_metadata'
         6: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/broker.rb:200:in `send_request'
         5: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/broker.rb:214:in `connection'
         4: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/connection_builder.rb:27:in `build_connection'
         3: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/sasl_authenticator.rb:58:in `authenticate!'
         2: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/sasl/gssapi.rb:25:in `authenticate!'
         1: from /usr/local/rvm/gems/ruby-2.6.3/gems/ruby-kafka-1.2.0/lib/kafka/sasl/gssapi.rb:72:in `initialize_gssapi_context'
/usr/local/rvm/gems/ruby-2.6.3/gems/gssapi-1.3.0/lib/gssapi/simple.rb:96:in `init_context': gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure.  Minor code may provide more information (GSSAPI::GssApiError)
Server not found in Kerberos database

[dasch]

I unfortunately do not have any experience with using Kerberos, but please provide the answer here if you figure it out.