Jakub Scholz created KAFKA-13937:
------------------------------------

             Summary: StandardAuthorizer throws "ID 5t1jQ3zWSfeVLMYkN3uong not 
found in aclsById" exceptions into broker logs
                 Key: KAFKA-13937
                 URL: https://issues.apache.org/jira/browse/KAFKA-13937
             Project: Kafka
          Issue Type: Bug
    Affects Versions: 3.2.0
            Reporter: Jakub Scholz


I'm trying to use the new {{StandardAuthorizer}} in a Kafka cluster running in 
KRaft mode. When managing the ACLs using the Admin API, the authorizer seems to 
throw a lot of runtime exceptions in the log. For example ...

When creating an ACL rule, it seems to create it just fine. But it throws the 
following exception:
{code:java}
2022-05-25 11:09:18,074 ERROR [StandardAuthorizer 0] addAcl error 
(org.apache.kafka.metadata.authorizer.StandardAuthorizerData) [EventHandler]
java.lang.RuntimeException: An ACL with ID 5t1jQ3zWSfeVLMYkN3uong already 
exists.
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizerData.addAcl(StandardAuthorizerData.java:169)
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizer.addAcl(StandardAuthorizer.java:83)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$19(BrokerMetadataPublisher.scala:234)
    at 
java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:671)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18(BrokerMetadataPublisher.scala:232)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18$adapted(BrokerMetadataPublisher.scala:221)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataPublisher.publish(BrokerMetadataPublisher.scala:221)
    at 
kafka.server.metadata.BrokerMetadataListener.kafka$server$metadata$BrokerMetadataListener$$publish(BrokerMetadataListener.scala:258)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2(BrokerMetadataListener.scala:119)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2$adapted(BrokerMetadataListener.scala:119)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.run(BrokerMetadataListener.scala:119)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventContext.run(KafkaEventQueue.java:121)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.handleEvents(KafkaEventQueue.java:200)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.run(KafkaEventQueue.java:173)
    at java.base/java.lang.Thread.run(Thread.java:829)
2022-05-25 11:09:18,076 ERROR [BrokerMetadataPublisher id=0] Error publishing 
broker metadata at OffsetAndEpoch(offset=3, epoch=1) 
(kafka.server.metadata.BrokerMetadataPublisher) [EventHandler]
java.lang.RuntimeException: An ACL with ID 5t1jQ3zWSfeVLMYkN3uong already 
exists.
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizerData.addAcl(StandardAuthorizerData.java:169)
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizer.addAcl(StandardAuthorizer.java:83)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$19(BrokerMetadataPublisher.scala:234)
    at 
java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:671)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18(BrokerMetadataPublisher.scala:232)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18$adapted(BrokerMetadataPublisher.scala:221)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataPublisher.publish(BrokerMetadataPublisher.scala:221)
    at 
kafka.server.metadata.BrokerMetadataListener.kafka$server$metadata$BrokerMetadataListener$$publish(BrokerMetadataListener.scala:258)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2(BrokerMetadataListener.scala:119)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2$adapted(BrokerMetadataListener.scala:119)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.run(BrokerMetadataListener.scala:119)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventContext.run(KafkaEventQueue.java:121)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.handleEvents(KafkaEventQueue.java:200)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.run(KafkaEventQueue.java:173)
    at java.base/java.lang.Thread.run(Thread.java:829)
2022-05-25 11:09:18,077 ERROR [BrokerMetadataListener id=0] Unexpected error 
handling HandleCommitsEvent (kafka.server.metadata.BrokerMetadataListener) 
[EventHandler]
java.lang.RuntimeException: An ACL with ID 5t1jQ3zWSfeVLMYkN3uong already 
exists.
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizerData.addAcl(StandardAuthorizerData.java:169)
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizer.addAcl(StandardAuthorizer.java:83)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$19(BrokerMetadataPublisher.scala:234)
    at 
java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:671)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18(BrokerMetadataPublisher.scala:232)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18$adapted(BrokerMetadataPublisher.scala:221)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataPublisher.publish(BrokerMetadataPublisher.scala:221)
    at 
kafka.server.metadata.BrokerMetadataListener.kafka$server$metadata$BrokerMetadataListener$$publish(BrokerMetadataListener.scala:258)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2(BrokerMetadataListener.scala:119)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2$adapted(BrokerMetadataListener.scala:119)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.run(BrokerMetadataListener.scala:119)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventContext.run(KafkaEventQueue.java:121)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.handleEvents(KafkaEventQueue.java:200)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.run(KafkaEventQueue.java:173)
    at java.base/java.lang.Thread.run(Thread.java:829) {code}
However, when I describe the ACL rules (again using the Admin API), they seem 
to be created and seem to work fine despite these errors.

Similarly, deleting the ACLs throws similar exceptions:
{code:java}
2022-05-25 11:10:04,261 ERROR [StandardAuthorizer 0] removeAcl error 
(org.apache.kafka.metadata.authorizer.StandardAuthorizerData) [EventHandler]
java.lang.RuntimeException: ID 5t1jQ3zWSfeVLMYkN3uong not found in aclsById.
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizerData.removeAcl(StandardAuthorizerData.java:189)
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizer.removeAcl(StandardAuthorizer.java:88)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$19(BrokerMetadataPublisher.scala:236)
    at 
java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:671)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18(BrokerMetadataPublisher.scala:232)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18$adapted(BrokerMetadataPublisher.scala:221)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataPublisher.publish(BrokerMetadataPublisher.scala:221)
    at 
kafka.server.metadata.BrokerMetadataListener.kafka$server$metadata$BrokerMetadataListener$$publish(BrokerMetadataListener.scala:258)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2(BrokerMetadataListener.scala:119)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2$adapted(BrokerMetadataListener.scala:119)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.run(BrokerMetadataListener.scala:119)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventContext.run(KafkaEventQueue.java:121)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.handleEvents(KafkaEventQueue.java:200)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.run(KafkaEventQueue.java:173)
    at java.base/java.lang.Thread.run(Thread.java:829)
2022-05-25 11:10:04,261 ERROR [BrokerMetadataPublisher id=0] Error publishing 
broker metadata at OffsetAndEpoch(offset=4, epoch=1) 
(kafka.server.metadata.BrokerMetadataPublisher) [EventHandler]
java.lang.RuntimeException: ID 5t1jQ3zWSfeVLMYkN3uong not found in aclsById.
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizerData.removeAcl(StandardAuthorizerData.java:189)
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizer.removeAcl(StandardAuthorizer.java:88)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$19(BrokerMetadataPublisher.scala:236)
    at 
java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:671)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18(BrokerMetadataPublisher.scala:232)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18$adapted(BrokerMetadataPublisher.scala:221)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataPublisher.publish(BrokerMetadataPublisher.scala:221)
    at 
kafka.server.metadata.BrokerMetadataListener.kafka$server$metadata$BrokerMetadataListener$$publish(BrokerMetadataListener.scala:258)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2(BrokerMetadataListener.scala:119)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2$adapted(BrokerMetadataListener.scala:119)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.run(BrokerMetadataListener.scala:119)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventContext.run(KafkaEventQueue.java:121)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.handleEvents(KafkaEventQueue.java:200)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.run(KafkaEventQueue.java:173)
    at java.base/java.lang.Thread.run(Thread.java:829)
2022-05-25 11:10:04,261 ERROR [BrokerMetadataListener id=0] Unexpected error 
handling HandleCommitsEvent (kafka.server.metadata.BrokerMetadataListener) 
[EventHandler]
java.lang.RuntimeException: ID 5t1jQ3zWSfeVLMYkN3uong not found in aclsById.
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizerData.removeAcl(StandardAuthorizerData.java:189)
    at 
org.apache.kafka.metadata.authorizer.StandardAuthorizer.removeAcl(StandardAuthorizer.java:88)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$19(BrokerMetadataPublisher.scala:236)
    at 
java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:671)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18(BrokerMetadataPublisher.scala:232)
    at 
kafka.server.metadata.BrokerMetadataPublisher.$anonfun$publish$18$adapted(BrokerMetadataPublisher.scala:221)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataPublisher.publish(BrokerMetadataPublisher.scala:221)
    at 
kafka.server.metadata.BrokerMetadataListener.kafka$server$metadata$BrokerMetadataListener$$publish(BrokerMetadataListener.scala:258)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2(BrokerMetadataListener.scala:119)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.$anonfun$run$2$adapted(BrokerMetadataListener.scala:119)
    at scala.Option.foreach(Option.scala:437)
    at 
kafka.server.metadata.BrokerMetadataListener$HandleCommitsEvent.run(BrokerMetadataListener.scala:119)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventContext.run(KafkaEventQueue.java:121)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.handleEvents(KafkaEventQueue.java:200)
    at 
org.apache.kafka.queue.KafkaEventQueue$EventHandler.run(KafkaEventQueue.java:173)
    at java.base/java.lang.Thread.run(Thread.java:829) {code}
Again, it seems to work fine and the ACL rules are deleted despite the 
exceptions being thrown.

This behaviour seems to be both with single node cluster as well as with 3 node 
clusters (in both cases all nodes had both controller and broker roles).

Reproducing this seems to be easy in my case with a very simple Admin API code:
{code:java}
KafkaPrincipal principal = new KafkaPrincipal("User", "my-user");

// Create ACL
AclBinding acl = new AclBinding(
        new ResourcePattern(ResourceType.TOPIC, "my-topic2", 
PatternType.LITERAL),
        new AccessControlEntry(principal.toString(), "*", AclOperation.WRITE, 
AclPermissionType.ALLOW)
);

admin.createAcls(List.of(acl)).all().get();

// Delete ACL
AclBindingFilter acl = new AclBindingFilter(
        new ResourcePatternFilter(ResourceType.TOPIC, "my-topic2", 
PatternType.LITERAL),
        new AccessControlEntryFilter(principal.toString(), "*", 
AclOperation.WRITE, AclPermissionType.ALLOW)
);

admin.deleteAcls(List.of(acl)).all().get(); {code}



--
This message was sent by Atlassian Jira
(v8.20.7#820007)

Reply via email to