SASL authentication error: Authentication failed

[Ferikl]

Description

Hi guys, we are trying to switch to new MSK (mskv4 with kRaft instead of zookeeper)

My project is Laravel based app and have such error:

sasl_ssl://xxxxx.amazonaws.com:9096/bootstrap: SASL authentication error: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512 (after 366ms in state AUTH_REQ)

Before switching to new version all works perfectly.

Tried to reset username and simplify password to avoid super special characters (while importing secrets from secret manager to pod)

Please help me 8)

PS
tried local python script to connect kafka and it works fine, thats why I decided to write this issue here

php-rdkafka Version

6.0.5

librdkafka Version

No response

PHP Version

PHP 8.3

Operating System

Debian GNU/Linux 12 (bookworm)

Kafka Version

No response

[Ferikl]

Tried to analize debug logs:

local call to AWS kafka

old (working)

....

%7|1755168646.080|SASLSCRAM|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: SASL SCRAM client in state server-first-message
%7|1755168646.085|SASL|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Send SASL Kafka frame to broker (189 bytes)
%7|1755168646.085|SEND|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Sent SaslAuthenticateRequest (v0, 214 bytes @ 0, CorrId 4)
%7|1755168646.120|RECV|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Received SaslAuthenticateResponse (v0, 98 bytes, CorrId 4, rtt 35.16ms)
%7|1755168646.120|SASL|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Received SASL frame from broker (90 bytes)
%7|1755168646.120|SASLSCRAM|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: SASL SCRAM client in state client-final-message
%7|1755168646.120|SCRAMAUTH|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: SASL SCRAM authentication successful on server: verifying ServerSignature
%7|1755168646.120|SCRAMAUTH|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Authenticated as modmin using SCRAM-SHA-512
%7|1755168646.120|STATE|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Broker changed state AUTH_REQ -> UP

you can see Received SaslAuthenticateResponse (v0, 98 bytes, CorrId 4, rtt 35.16ms)

new (broken)

....

%7|1755168731.141|SASLSCRAM|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: SASL SCRAM client in state server-first-message
%7|1755168731.147|SASL|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Send SASL Kafka frame to broker (189 bytes)
%7|1755168731.147|SEND|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Sent SaslAuthenticateRequest (v0, 214 bytes @ 0, CorrId 4)
%7|1755168731.410|RECV|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Received SaslAuthenticateResponse (v0, 112 bytes, CorrId 4, rtt 262.84ms)
%7|1755168731.410|FAIL|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: SASL authentication error: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512 (after 304ms in state AUTH_REQ) (_AUTHENTICATION)
%3|1755168731.410|FAIL|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: SASL authentication error: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512 (after 304ms in state AUTH_REQ)
%7|1755168731.410|STATE|rdkafka#producer-1| [thrd:sasl_ssl://_broker_]: sasl_ssl://_broker_/bootstrap: Broker changed state AUTH_REQ -> DOWN
...

and here we have Received SaslAuthenticateResponse (v0, 112 bytes, CorrId 4, rtt 262.84ms)