Repository: provectus/kafka-ui
Issue: Can't connect to Kafka with SASL
Labels: type/bug
scope/backend

Hi, i have kafka installed with docker and running with SASL_PLAINTEXT, when i try to go to the kafka ui web page, i only get 500 Error. This is my config

  kafka-ui:
    image: provectuslabs/kafka-ui
    container_name: kafka-ui
    networks:
      - kafka_installation_default
    ports:
      - "8080:8080"
    environment:
      KAFKA_CLUSTERS_0_NAME: 'local'
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: 'kafka:9092'
      KAFKA_CLUSTERS_0_ZOOKEEPER: 'zookeeper:2181'
      KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SASL_PLAINTEXT
      KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM: PLAIN
      KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG: 'org.apache.kafka.common.security.plain.PlainLoginModule required username="enzo" password="cisternino"'

Issue comments:
Hi, @EnzOuille thanks for sharing this issue. Could you please provide your kafka config for example in a docker compose file. This will help us to reproduce this issue. 
Hi thanks for the quick answer, below is my config of kafka in docker :

  kafka:
    image: wurstmeister/kafka:latest
    hostname: kafka
    container_name: kafka
    networks:
      - kafka_installation_default
    depends_on:
      - zookeeper
    ports:
      - '9092:9092'
    environment:
      KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'
      KAFKA_LISTENERS: SASL_PLAINTEXT://:9092
      KAFKA_ADVERTISED_LISTENERS:  SASL_PLAINTEXT://192.168.0.34:9092
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: 'true'
      ALLOW_PLAINTEXT_LISTENER: 'yes'
      KAFKA_OPTS: "-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf"
      KAFKA_AUTHORIZER_CLASS_NAME: kafka.security.auth.SimpleAclAuthorizer
      KAFKA_INTER_BROKER_LISTENER_NAME: SASL_PLAINTEXT
      KAFKA_SASL_ENABLED_MECHANISMS: PLAIN
      KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN
      KAFKA_SECURITY_PROTOCOL: SASL_PLAINTEXT
      KAFKA_SUPER_USERS: User:admin,User:enzo
      KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: 'true'
    volumes:
    - /var/lib/docker/volumes/kafka_vol/_data:/etc/kafka

And this is the jaas file config 

KafkaServer {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="admin"
    password="admin-secret"
    user_admin="admin-secret"
    user_enzo="cisternino";
};

KafkaClient {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    user_admin="admin-secret";
};

Client {};
@EnzOuille thanks for quick sharing, we'll try it locally and return to you soon. 
[Documentation ](https://github.com/provectus/kafka-ui#connecting-to-a-secure-broker) says "To be continued"
What is the correct way to set username and password for SASL using kafka-ui env vars?
@germanosin ok thanks for that ! 
@EnzOuille, looks like you missed trailing *;*.
I created example docker compose here: https://github.com/provectus/kafka-ui/blob/master/docker/kafka-ui-sasl.yaml#L19
My bad, thanks for that, it's all working now !!! Thanks for your time.
@EnzOuille you are always welcome)

Pull request review comments:

Patch that resolved the issue:
diff --git a/docker/jaas/client.properties b/docker/jaas/client.properties
new file mode 100644
index 00000000000..db1feea1f81
--- /dev/null
+++ b/docker/jaas/client.properties
@@ -0,0 +1,3 @@
+sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin-secret";
+security.protocol=SASL_PLAINTEXT
+sasl.mechanism=PLAIN
\ No newline at end of file
diff --git a/docker/jaas/kafka_server.conf b/docker/jaas/kafka_server.conf
new file mode 100644
index 00000000000..ef41c992e21
--- /dev/null
+++ b/docker/jaas/kafka_server.conf
@@ -0,0 +1,14 @@
+KafkaServer {
+    org.apache.kafka.common.security.plain.PlainLoginModule required
+    username="admin"
+    password="admin-secret"
+    user_admin="admin-secret"
+    user_enzo="cisternino";
+};
+
+KafkaClient {
+    org.apache.kafka.common.security.plain.PlainLoginModule required
+    user_admin="admin-secret";
+};
+
+Client {};
\ No newline at end of file
diff --git a/docker/kafka-ui-sasl.yaml b/docker/kafka-ui-sasl.yaml
new file mode 100644
index 00000000000..87b1094be7f
--- /dev/null
+++ b/docker/kafka-ui-sasl.yaml
@@ -0,0 +1,51 @@
+---
+version: '2'
+services:
+
+  kafka-ui:
+    container_name: kafka-ui
+    image: provectuslabs/kafka-ui:latest
+    ports:
+      - 8080:8080
+    depends_on:
+      - zookeeper
+      - kafka
+    environment:
+      KAFKA_CLUSTERS_0_NAME: local
+      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:9092
+      KAFKA_CLUSTERS_0_ZOOKEEPER: zookeeper:2181
+      KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SASL_PLAINTEXT
+      KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM: PLAIN
+      KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG: 'org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin-secret";'
+  zookeeper:
+    image: confluentinc/cp-zookeeper:5.2.4
+    environment:
+      ZOOKEEPER_CLIENT_PORT: 2181
+      ZOOKEEPER_TICK_TIME: 2000
+    ports:
+      - 2181:2181
+
+  kafka:
+    image: wurstmeister/kafka:latest
+    hostname: kafka
+    container_name: kafka
+    depends_on:
+      - zookeeper
+    ports:
+      - '9092:9092'
+    environment:
+      KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'
+      KAFKA_LISTENERS: SASL_PLAINTEXT://kafka:9092
+      KAFKA_ADVERTISED_LISTENERS: SASL_PLAINTEXT://kafka:9092
+      KAFKA_AUTO_CREATE_TOPICS_ENABLE: 'true'
+      ALLOW_PLAINTEXT_LISTENER: 'yes'
+      KAFKA_OPTS: "-Djava.security.auth.login.config=/etc/kafka/jaas/kafka_server.conf"
+      KAFKA_AUTHORIZER_CLASS_NAME: kafka.security.auth.SimpleAclAuthorizer
+      KAFKA_INTER_BROKER_LISTENER_NAME: SASL_PLAINTEXT
+      KAFKA_SASL_ENABLED_MECHANISMS: PLAIN
+      KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN
+      KAFKA_SECURITY_PROTOCOL: SASL_PLAINTEXT
+      KAFKA_SUPER_USERS: User:admin,User:enzo
+      KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: 'true'
+    volumes:
+      - ./jaas:/etc/kafka/jaas
\ No newline at end of file


Test patch: