{"action":"created","issue":{"url":"https://api.github.com/repos/edenhill/librdkafka/issues/1146","repository_url":"https://api.github.com/repos/edenhill/librdkafka","labels_url":"https://api.github.com/repos/edenhill/librdkafka/issues/1146/labels{/name}","comments_url":"https://api.github.com/repos/edenhill/librdkafka/issues/1146/comments","events_url":"https://api.github.com/repos/edenhill/librdkafka/issues/1146/events","html_url":"https://github.com/edenhill/librdkafka/issues/1146","id":217694574,"number":1146,"title":"rdns=false a nogo?","user":{"login":"automaticgiant","id":2954612,"avatar_url":"https://avatars1.githubusercontent.com/u/2954612?v=3","gravatar_id":"","url":"https://api.github.com/users/automaticgiant","html_url":"https://github.com/automaticgiant","followers_url":"https://api.github.com/users/automaticgiant/followers","following_url":"https://api.github.com/users/automaticgiant/following{/other_user}","gists_url":"https://api.github.com/users/automaticgiant/gists{/gist_id}","starred_url":"https://api.github.com/users/automaticgiant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/automaticgiant/subscriptions","organizations_url":"https://api.github.com/users/automaticgiant/orgs","repos_url":"https://api.github.com/users/automaticgiant/repos","events_url":"https://api.github.com/users/automaticgiant/events{/privacy}","received_events_url":"https://api.github.com/users/automaticgiant/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-03-28T21:14:24Z","updated_at":"2017-04-05T19:54:47Z","closed_at":null,"body":"Description\r\n===========\r\ncan't achieve `rdns=false` functionality.\r\nidk if it's a heimdal bug (i'm on osx), but i tried providing a krb5.conf (with `rdns=false`) and specifying location in `KRB5_CONFIG` but it wants to handshake with a re-resolved fqdn instead of the cname that the spn is for.\r\nmight not be your problem, but i saw in the docs that you say that broker arg must match spn, and didn't know if that was a choice made in development of this library.\r\nthis isn't necessarily true of the jvm client, though idk for sure if it is a matter of client dns resolution (jvm or librdkafka) or if it is more the responsibility of the underlying krb/gssapi.\r\nso more info would be great, or suggestion/assessment of a fix (mine or yours) would be awesome.\r\n\r\n\r\nHow to reproduce\r\n================\r\n```\r\nbrew install kafkacat\r\nKRB5_CONFIG=./krb5.conf kafkacat -v -d security -t test -b asdp0103.cloud:9092 -X security.protocol=sasl_ssl -X sasl.kerberos.kinit.cmd='kinit -t keytab' -C -X ssl.ca.location=dev_ca.pem\r\n```\r\n\r\nChecklist\r\n=========\r\nPlease provide the following information:\r\n\r\n - [?] librdkafka version (release number or git tag): kafkacat librdkafka 0.9.4\r\n - [x] Apache Kafka version: confluent 3\r\n - [x] librdkafka client configuration: default, aside from specified in command\r\n - [x] Operating system: osx sierra\r\n - [x] Using the legacy Consumer no\r\n - [x] Using the high-level KafkaConsumer yes\r\n - [x] Provide logs (with `debug=..` as necessary) from librdkafka\r\n - [ ] Provide broker log excerpts\r\n - [x] Critical issue - would have to replace with jvm client or change spns\r\n\r\n```\r\n%7|1490734297.585|SSLVERIFY|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: Broker SSL certificate verified\r\n%7|1490734297.585|AUTH|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: Auth in state CONNECT (handshake not supported)\r\n%7|1490734297.585|SASL|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: Initializing SASL client: service name kafka, hostname asdp0103.cloud, mechanisms GSSAPI\r\n%7|1490734297.585|SASLREFRESH|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: Refreshing SASL keys with command: kinit -t keytab\r\nEncryption type arcfour-hmac-md5(23) used for authentication is weak and will be deprecated\r\n%7|1490734297.652|SASLREFRESH|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: SASL key refreshed\r\n%7|1490734297.653|SASL|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: My supported SASL mechanisms: SRP GSSAPI GSSAPI DIGEST-MD5 WEBDAV-DIGEST EXTERNAL SMB-NTLMv2 DHX APOP CRAM-MD5 NTLM MS-CHAPv2 PLAIN-CLIENTTOKEN ATOKEN PLAIN OAUTHBEARER LOGIN XOAUTH2 ANONYMOUS\r\n%2|1490734297.735|LIBSASL|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: GSSAPI Error:  Miscellaneous failure (see text (Server (kafka/ip-204-92-65.dqa@DQA) unknown)\r\n%3|1490734297.735|FAIL|rdkafka#consumer-1| [thrd:sasl_ssl://asdp0103.cloud:9092/bootstrap]: sasl_ssl://asdp0103.cloud:9092/bootstrap: Failed to initialize SASL authentication: SASL handshake failed (start (-1)): SASL(-1): generic failure: GSSAPI Error:  Miscellaneous failure (see text (Server (kafka/ip-204-92-65.dqa@DQA) unknown)\r\n% Fatal error at consumer_run:584:\r\n% ERROR: Failed to query metadata for topic test: Local: Broker transport failure\r\n```"},"comment":{"url":"https://api.github.com/repos/edenhill/librdkafka/issues/comments/291978121","html_url":"https://github.com/edenhill/librdkafka/issues/1146#issuecomment-291978121","issue_url":"https://api.github.com/repos/edenhill/librdkafka/issues/1146","id":291978121,"user":{"login":"edenhill","id":524990,"avatar_url":"https://avatars3.githubusercontent.com/u/524990?v=3","gravatar_id":"","url":"https://api.github.com/users/edenhill","html_url":"https://github.com/edenhill","followers_url":"https://api.github.com/users/edenhill/followers","following_url":"https://api.github.com/users/edenhill/following{/other_user}","gists_url":"https://api.github.com/users/edenhill/gists{/gist_id}","starred_url":"https://api.github.com/users/edenhill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edenhill/subscriptions","organizations_url":"https://api.github.com/users/edenhill/orgs","repos_url":"https://api.github.com/users/edenhill/repos","events_url":"https://api.github.com/users/edenhill/events{/privacy}","received_events_url":"https://api.github.com/users/edenhill/received_events","type":"User","site_admin":false},"created_at":"2017-04-05T19:54:47Z","updated_at":"2017-04-05T19:54:47Z","body":"librdkafka allows you to configure the kinit command to your liking, see `sasl.kerberos.kinit.cmd` in [CONFIGURATION.md](https://github.com/edenhill/librdkafka/blob/master/CONFIGURATION.md)"}}
{"actor":{"display_login":"edenhill"}}