Uploaded image for project: 'AMQ Streams'
  1. AMQ Streams
  2. ENTMQST-6982

[PROD] Streams 3.1.0 CR1 - Kafka 4.1.0 has issues with OPA plugin

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • 3.1.0.GA
    • None
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • False

      During our testing we found an issue with Kafka 4.1.0 and integration with OPA plugin for authz. We are getting these errors:

      2025-11-19 10:48:42 ERROR [data-plane-kafka-request-handler-1] KafkaApis:79 - [KafkaApi-1] Unexpected error handling request RequestHeader(apiKey=METADATA, apiVersion=13, clientId=my-consumer, correlationId=2, headerVersion=2) -- MetadataRequestData(topics=[MetadataRequestTopic(topicId=AAAAAAAAAAAAAAAAAAAAAA, name='my-topic-109087719-1023545295')], allowAutoTopicCreation=true, includeClusterAuthorizedOperations=false, includeTopicAuthorizedOperations=false) with context RequestContext(header=RequestHeader(apiKey=METADATA, apiVersion=13, clientId=my-consumer, correlationId=2, headerVersion=2), connectionId='10.130.2.176:9093-10.128.3.11:43132-3-0', clientAddress=/10.128.3.11, principal=User:CN=good-user, listenerName=ListenerName(TLS-9093), securityProtocol=SSL, clientInformation=ClientInformation(softwareName=apache-kafka-java, softwareVersion=4.1.0.redhat-00002), fromPrivilegedListener=false, principalSerde=Optional[org.apache.kafka.common.security.authenticator.DefaultKafkaPrincipalBuilder@250e7721])
      com.google.common.util.concurrent.ExecutionError: java.lang.NoClassDefFoundError: com/thoughtworks/paranamer/Paranamer
      	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2085) ~[guava-32.1.3.jre-redhat-00001.jar:?]
      	at com.google.common.cache.LocalCache.get(LocalCache.java:4019) ~[guava-32.1.3.jre-redhat-00001.jar:?]
      	at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4933) ~[guava-32.1.3.jre-redhat-00001.jar:?]
      	at org.openpolicyagent.kafka.OpaAuthorizer.allowAccess$1(OpaAuthorizer.scala:190) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017]
      	at org.openpolicyagent.kafka.OpaAuthorizer.doAuthorize(OpaAuthorizer.scala:201) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017]
      	at org.openpolicyagent.kafka.OpaAuthorizer.authorizeAction(OpaAuthorizer.scala:157) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017]
      	at org.openpolicyagent.kafka.OpaAuthorizer.$anonfun$authorize$1(OpaAuthorizer.scala:55) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017]
      	at scala.collection.StrictOptimizedIterableOps.map(StrictOptimizedIterableOps.scala:100) ~[scala-library-2.13.16.redhat-00001.jar:?]
      	at scala.collection.StrictOptimizedIterableOps.map$(StrictOptimizedIterableOps.scala:87) ~[scala-library-2.13.16.redhat-00001.jar:?]
      	at scala.collection.mutable.ArrayBuffer.map(ArrayBuffer.scala:42) ~[scala-library-2.13.16.redhat-00001.jar:?]
      	at org.openpolicyagent.kafka.OpaAuthorizer.authorize(OpaAuthorizer.scala:55) ~[opa-authorizer-1.5.1.redhat-00017.jar:1.5.1.redhat-00017]
      	at kafka.server.AuthHelper.filterByAuthorized(AuthHelper.scala:113) ~[kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003]
      	at kafka.server.KafkaApis.handleTopicMetadataRequest(KafkaApis.scala:906) [kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003]
      	at kafka.server.KafkaApis.handle(KafkaApis.scala:172) [kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003]
      	at kafka.server.KafkaRequestHandler.run(KafkaRequestHandler.scala:158) [kafka_2.13-4.1.0.redhat-00003.jar:4.1.0.redhat-00003]
      	at java.base/java.lang.Thread.run(Thread.java:840) [?:?]
      Caused by: java.lang.NoClassDefFoundError: com/thoughtworks/paranamer/Paranamer
      	at com.fasterxml.jackson.module.scala.introspect.BeanIntrospector$.getCtorParams(BeanIntrospector.scala:245) ~[jackson-module-scala_2.13-2.19.2.redhat-00003.jar:?]
      	at com.fasterxml.jackson.module.scala.introspect.BeanIntrospector$.$anonfun$apply$2(BeanIntrospector.scala:53) ~
      ... 

      For Kafka 4.0.0 it seems that everything works just fine, it's issue just with Kafka 4.1.0.

              Unassigned Unassigned
              lkral Lukas Kral
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: