I'm having trouble with 'Cannot change principals during re-authentication from A: B'

[ksundong]

Environment

• org.apache.kafka:kafka-clients:3.1.1
• software.amazon.msk:aws-msk-iam-auth:1.1.5
• org.springframework.cloud:spring-cloud-stream:3.2.1
• org.springframework.cloud:spring-cloud-stream-binder-kafka:3.2.1
• org.springframework.boot:spring-boot:2.7.1

Log

server 2023-01-31 14:05:26.312 ERROR 7 --- [container-0-C-1] o.s.k.l.KafkaMessageListenerContainer   :149 : Authentication/Authorization Exception, retrying in 10000 ms
server
server org.apache.kafka.common.errors.SaslAuthenticationException: Cannot change principals during re-authentication from A: B

• Why server cannot change A to B?
• How can I fix it?

[amplexus]

Set AWS_ROLE_SESSION_NAME. See jmaver-plume/kafkajs-msk-iam-authentication-mechanism#20 for more info.

[ksundong]

@amplexus
I'll try it, thanks.

[hameno]

Surely this should not be needed to manually configure, no?

[taer]

This pops up also when you use EKS-pod-identity and the session name changes. And you can't as of now set a static session name. Would it be possible to relax the sessionName aspect of the "principals change"?