OIDC (Okta) issue with using callback handler for AWS_IAM_MSK

[ivanbishop]

Issue submitter TODO list

• I've looked up my issue in FAQ
• I've searched for an already existing issues here
• I've tried running main-labeled docker image and the issue still persists there
• I'm running a supported version of the application which is listed here

Describe the bug (actual behavior)

See https://discord.com/channels/897805035122077716/1298004148066848849
Validate with Okta works OK, but om submit I get a 500 error.
logit.txt
YML-config-compose.zip

Expected behavior

Validate works on adding a new cluster but I expect Submit to work

Your installation details

Run via (compose in ZIP)
docker-compose -f ~/kui/docker-compose.yml up -d
and the external rbac file in ZIP too

Steps to reproduce

launch container, try and configure a new cluster

Screenshots

No response

Logs

logit.txt

Additional context

No response

[github-actions]

Hi ivanbishop! 👋

Welcome, and thank you for opening your first issue in the repo!

Please wait for triaging by our maintainers.

As development is carried out in our spare time, you can support us by sponsoring our activities or even funding the development of specific issues.
Sponsorship link

If you plan to raise a PR for this issue, please take a look at our contributing guide.

[kothapet]

@ivanbishop,

OKTA sso with MSK IAM works fine. I have this running.

Looks like you have an extra semicolon ; at the end of client.callback.handler.class line. Remove it.
Only jass.config needs semicolon ; at the end.

You have

KAFKA_CLUSTERS_0_PROPERTIES_SASL_CLIENT_CALLBACK_HANDLER_CLASS: software.amazon.msk.auth.iam.IAMClientCallbackHandler;

Make it

KAFKA_CLUSTERS_0_PROPERTIES_SASL_CLIENT_CALLBACK_HANDLER_CLASS: software.amazon.msk.auth.iam.IAMClientCallbackHandler

And that should work.

[kothapet]

I looked at your config and compared to mine, and pretty much same except
I dont have jwk-set-uri in okta config
I have given permissions to consumer as you will to browse the topics.
I have additional glue serde, and audit settings but those are optional.

Which servers are you getting 500 errors from? from kafkaui or okta? it seems from the logs authentication is working and its sending the group kafbat-admins back.