Environment:

• Streamsets Data Collector All version.
• Oracle Java 1.8u351.

Issue:

It has been observed that data collector and Kafka pipeline[with SASL protocol] starts failing after Java upgrade to 1.8u351 version.

This error appears on data collector logs:

abnormal exit: java.lang.RuntimeException: Could not get Kerberos credentials: javax.security.auth.login.LoginException: Unable to obtain password from user
Check STDERR for more details
java.lang.RuntimeException: Could not get Kerberos credentials: javax.security.auth.login.LoginException: Unable to obtain password from user
    at com.streamsets.datacollector.security.SecurityContext.login(SecurityContext.java:160)
    at com.streamsets.datacollector.main.Main.doMain(Main.java:94)
    at com.streamsets.datacollector.main.DataCollectorMain.main(DataCollectorMain.java:41)

Kafka pipeline errors:

GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: KDC has no support for encryption type (14))]) occurred when evaluating SASL token received from the Kafka Broker. Kafka Client will go to AUTHENTICATION_FAILED state.

As per the java release notes, The des3-hmac-sha1 and rc4-hmac Kerberos encryption types (etypes) are now deprecated and disabled by default. Users can set “allow_weak_crypto = true” in the krb5.conf configuration file to re-enable them.

JDK 8u351 Update Release Notes:

https://www.oracle.com/java/technologies/javase/8u351-relnotes.html#JDK-8139348

➜ Deprecate 3DES and RC4 in Kerberos ( JDK-8139348 )

The des3-hmac-sha1 and rc4-hmac Kerberos encryption types (etypes) are now deprecated and disabled by default. Users can set allow_weak_crypto = true in the krb5.conf configuration file to re-enable them (along with other weak etypes including des-cbc-crc and des-cbc-md5) at their own risk. To disable a subset of the weak etypes, users can list preferred etypes explicitly in any of the default_tkt_enctypes, default_tgs_enctypes, or permitted_enctypes settings.

There are 2 options to fix the issue:

1. Regenerate the keytab using the more secure type.
2. As a temporary fix, We can set “allow_weak_crypto=true” in krb5.conf to allow those less secure encryption.

This is more of an environment related issue and needs to be checked by kerbrose and the platform team as well.

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.