Newer versions kafka-python (> 2.0.3) fail when authing against kerberos using GSSAPI / SASL_PLAINTEXT

[rja1]

The broker will throw the below error. It's confusing because authentication errors usually cause the consumer to fail immediately. However in this case, it seems to connect initially, then just hangs forever (netstat show an established connection) then broker throws the error.

Downgrading to kafka-python==2.0.3 works fine.

========================
Error:
[2025-06-10 11:26:49,267] INFO [SocketServer listenerType=ZK_BROKER, nodeId=5] Failed authentication with /10.119.6.47 (Authentication failed during authentication due to invalid credentials with SASL mechanism GSSAPI) (org.apache.kafka.common.network.Selector)
[2025-06-10 11:26:49,744] INFO [SocketServer listenerType=ZK_BROKER, nodeId=5] Failed authentication with /10.119.6.47 (Authentication failed during authentication due to invalid credentials with SASL mechanism GSSAPI) (org.apache.kafka.common.network.Selector)

=========================
Version Info:

Python 3.12.3

Working Python package versions:
pip list
Package Version

---

gssapi 1.9.0
kafka-python 2.0.3
krbticket 1.0.6

Kafka version:
Kafka version: 2.8.0

Code snippet:

from kafka import KafkaConsumer
from krbticket import KrbConfig, KrbCommand
import os

try:
os.environ['KRB5CCNAME'] = '/tmp/krb5cc_username'
kconfig = KrbConfig(principal='kafka-client@DOMAIN.COM', keytab='/path/kafka_client.keytab')
KrbCommand.kinit(kconfig)

except Exception as e:
print(f"An error occurred: {e}")

try:
consumer = KafkaConsumer(
"some_topic",
group_id = 'some_group',
bootstrap_servers = 'some_host:9092',
security_protocol = "SASL_PLAINTEXT",
sasl_mechanism = "GSSAPI"
)
except Exception as e:
print(f"An error occurred: {e}")

for msg in consumer:
try:
print(msg)
except Exception as e:
print(f"An error occurred: {e}")

[dpkp]

Thanks, I was able to reproduce this locally and fix should merge soon.

[rja1]

Thanks a lot for fixing this @dpkp !!!!