How to configure kafkaui with SASL_SSL/OAUTH2?

[BlackCorsair]

Hi!
We're moving from connecting kafkaui to kafka brokers from an internal tls listener to the one everyone else in our organization is using, which is is using oauth for the authentication.

We have the following configuration (from what I could scavenge from other questions):

          env:
          - name: KAFKA_CLUSTERS_0_READONLY
            value: "true"
          - name: KAFKA_CLUSTERS_0_NAME
            value: kafka-prod
          - name: KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS
            value: kafka-prod-url
          - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI
            value: auth_provider/authorize
          - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
            value: SASL_SSL
          - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM
            value: OAUTHBEARER
          - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
            value: org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required clientId="id" clientSecret="secret";
          - name: KAFKA_CLUSTERS_0_SCHEMAREGISTRY
            value: schema-registry-url

However, we're facing the following error:

Failed to collect cluster kafka-prod info                                                                                                    
java.lang.IllegalStateException: Error while creating AdminClient for Cluster kafka-prod                                                                                                                          
    at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$3(AdminClientServiceImpl.java:45)                                                                                               
    at reactor.core.publisher.Mono.lambda$onErrorMap$31(Mono.java:3733)                                                                                                                                               
    at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:94)                                                                                                                   
    at reactor.core.publisher.Operators.error(Operators.java:198)                                                                                                                                                     
    at reactor.core.publisher.FluxFlatMap.trySubscribeScalarMap(FluxFlatMap.java:135)                                                                                                                                 
    at reactor.core.publisher.MonoFlatMap.subscribeOrReturn(MonoFlatMap.java:53)                                                                                                                                      
    at reactor.core.publisher.Mono.subscribe(Mono.java:4385)                                                                                                                                                          
    at reactor.core.publisher.FluxSwitchIfEmpty$SwitchIfEmptySubscriber.onComplete(FluxSwitchIfEmpty.java:82)                                                                                                         
    at reactor.core.publisher.Operators.complete(Operators.java:137)                                                                                                                                                  
    at reactor.core.publisher.MonoEmpty.subscribe(MonoEmpty.java:46)                                                                                                                                                  
    at reactor.core.publisher.Mono.subscribe(Mono.java:4400)                                                                                                                                                          
    at reactor.core.publisher.FluxFlatMap$FlatMapMain.onNext(FluxFlatMap.java:426)                                                                                                                                    
    at reactor.core.publisher.FluxPublishOn$PublishOnSubscriber.runAsync(FluxPublishOn.java:440)                                                                                                                      
    at reactor.core.publisher.FluxPublishOn$PublishOnSubscriber.run(FluxPublishOn.java:527)                                                                                                                           
    at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:84)                                                                                                                                                     
    at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:37)                                                                                                                                                     
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)                                                                                                                                             
    at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)                                                                                       
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)                                                                                                                      
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)                                                                                                                      
    at java.base/java.lang.Thread.run(Thread.java:830)                                                                                                                                                                
Caused by: org.apache.kafka.common.KafkaException: Failed to create new KafkaAdminClient                                                                                                                              
    at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:540)                                                                                                                      
    at org.apache.kafka.clients.admin.Admin.create(Admin.java:134)                                                                                                                                                    
    at org.apache.kafka.clients.admin.AdminClient.create(AdminClient.java:39)                                                                                                                                         
    at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$2(AdminClientServiceImpl.java:41)                                                                                               
    at reactor.core.publisher.MonoSupplier.call(MonoSupplier.java:86)                                                                                                                                                 
    at reactor.core.publisher.FluxFlatMap.trySubscribeScalarMap(FluxFlatMap.java:127)                                                                                                                                 
    ... 16 common frames omitted                                                                                                                                                                                      
Caused by: org.apache.kafka.common.KafkaException: javax.security.auth.login.LoginException: An internal error occurred while retrieving token from callback handler                                                  
    at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:184)                                                                                                                      
    at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:192)                                                                                                                               
    at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:81)                                                                                                                  
    at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:105)                                                                                                                                
    at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:513)                                                                                                                      
    ... 21 common frames omitted                                                                                                                                                                                      
Caused by: javax.security.auth.login.LoginException: An internal error occurred while retrieving token from callback handler                                                                                          
    at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.identifyToken(OAuthBearerLoginModule.java:319)                                                                                             
    at org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule.login(OAuthBearerLoginModule.java:301)                                                                                                     
    at java.base/javax.security.auth.login.LoginContext.invoke(LoginContext.java:726)                                                                                                                                 
    at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:665)                                                                                                                                  
    at java.base/javax.security.auth.login.LoginContext$4.run(LoginContext.java:663)                                                                                                                                  
    at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)                                                                                                                               
    at java.base/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:663)                                                                                                                             
    at java.base/javax.security.auth.login.LoginContext.login(LoginContext.java:574)                                                                                                                                  
    at org.apache.kafka.common.security.oauthbearer.internals.expiring.ExpiringCredentialRefreshingLogin.login(ExpiringCredentialRefreshingLogin.java:204)                                                            
    at org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerRefreshingLogin.login(OAuthBearerRefreshingLogin.java:150)                                                                                   
    at org.apache.kafka.common.security.authenticator.LoginManager.<init>(LoginManager.java:62)                                                                                                                       
    at org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:105)                                                                                                         
    at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:170)                                                                                                                      
    ... 25 common frames omitted

I understand that the issue here is that when the client tries to get the token, it fails, but I don't know if it's because I'm missing some env variable or maybe the SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI value is wrong.

Could you guide me?

Thanks!

[germanosin]

Me and @Haarolean no longer support this repo, please reopen your question in https://github.com/kafbat/kafka-ui/discussions