SASL GSSAPI Cannot contact any KDC for realm about brod_gssapi HOT 1 OPEN

Hi @elainel8,

First of all, since you asked the question a couple of months ago, I want to apologize for late response and ask if you have already resolved the issue by yourself or if you are still having problems?

That realm is defined under my krb5.conf, which is located under /etc/
I have also set this environment variable: export KAFKA_OPTS="-Djava.security.krb5.conf=/etc/krb5.conf"
Do I need to load this file somewhere else?

Yes, this file is needed also by the Kerberos KDC. It should be picked up automatically if it is located in location that the Kerberos expect (please see the documentation of your Kerberos library).

It might also be useful to look at our docker compose file that we use to set up a Kerberos and Kafka environment to perform continues testing: https://github.com/emqx/emqx/blob/master/.ci/docker-compose-file/docker-compose-kafka.yaml .

The error message "SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Cannot contact any KDC for realm 'BELLDEV.DEV.BCE.CA')" suggests that the Kerberos authentication process is failing due to an inability to contact the Key Distribution Center (KDC) for your specified realm.

Here are some things that you can check:

• Verify that the Key Distribution Center (KDC) for the realm 'BELLDEV.DEV.BCE.CA' is reachable from your machines. For example using ping.

• Double-check your /etc/krb5.conf file to ensure the realm and KDC are correctly specified. Make sure there are no typos or incorrect configurations.

• Confirm that the keytab file and principal are correctly configured: https://stackoverflow.com/questions/63723556/keytab-file-authentication-check

from brod_gssapi.