apache/skywalking

Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP.

Open

#13849 opened on Apr 27, 2026

View on GitHub
 (4 comments) (0 reactions) (0 assignees)Java (24,794 stars) (6,648 forks)batch import
bugdependenciesgood first issue

Description

Search before asking

  • I had searched in the issues and found no similar issues.

Apache SkyWalking Component

OAP server (apache/skywalking)

What happened

\n "index": 0,\n "description": "```\nat java.base/java.lang.Thread.run(Unknown Source)\n\njava.io.IOException: Channel could not be created for socket java.nio.channels.SocketChannel[closed]\n at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:239)\n at org.apache.kafka.common.network.Selector.connect(Selector.java:256)\n at org.apache.kafka.common.network.Selector.init(Selector.java:992)\n at org.apache.kafka.clients.NetworkClient.(NetworkClient.java:301)\n at org.apache.kafka.clients.admin.KafkaAdminClient.(KafkaAdminClient.java:1141)\n at org.apache.kafka.clients.admin.KafkaAdminClient.(KafkaAdminClient.java:1401)\n at java.base/java.lang.Thread.run(Unknown Source)\nCaused by: org.apache.kafka.common.KafkaException: Failed to configure SaslClientAuthenticator\n at org.apache.kafka.common.errors.SaslAuthenticationException: Failed to configure SaslClientAuthenticator\n at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:338)\n ... 8 more\nCaused by: java.lang.UnsupportedOperationException: SubSubject is not supported\n at java.base/java.lang.Subject.getSubject(Unknown Source)\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.(SaslClientAuthenticatorImpl.java:140)\n at java.security.sasl/com.sun.security.sasl.ClientFactoryImpl.createSaslClient(Unknown Source)\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.lambda$createSaslClient$0(SaslClientAuthenticator.java:219)\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.withoutAuthenticator(Unknown Source)\n at java.base/jdk.internal.vm.Scope$ScopeValueContainer.call(Unknown Source)\n at java.base/jdk.internal.vm.Scope.withScope(Unknown Source)\n at java.base/javax.security.auth.Subject.calls(Unknown Source)\n

What you expected to happen

It is possible to start pulling metrics and trace data from Kafak normally.

How to reproduce

The skywalking10.4.0 version encounters an error when starting up because the kafka-fetcher is set to the SASL_SSL security mode. However, this issue does not occur with the 10.1.0 version.

Anything else

No response

Are you willing to submit a pull request to fix on your own?

  • Yes I am willing to submit a pull request on my own!

Code of Conduct

Contributor guide

Tech stack
java
Domain
backendobservability
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Kafka basicsSASL authenticationSkyWalking OAP architecture
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30
Research direction
Investigate the error stack trace, focusing on the `SubSubject is not supported` exception in `javax.security.auth.Subject.getSubject`. Compare the Kafka client library version and Java version used in SkyWalking 10.4.0 versus 10.1.0. Determine if a Java upgrade or Kafka client change introduced incompatibility with SASL SSL. Look at `org.apache.kafka.common.security.sasl.SaslClientAuthenticator` and the `Subject` usage. Check if any OAP configuration changes can work around the issue.