IAM based authentication is slower compared to SCRAM-SHA-512

[sangeethsasidharan]

• aws-msk-iam-sasl-signer-python version: 1.0.0
• Python version: 3.11
• Operating System: Mac OS
• Method of installation: pip
• Kafka library name: kafka-python
• Kafka library version: 2.0.2

user name password authentication
`
consumer = KafkaConsumer(
security_protocol="SASL_SSL",
sasl_mechanism="SCRAM-SHA-512",
sasl_plain_username=self.config.KAFKA_USER,
sasl_plain_password=self.config.KAFKA_PASSWORD,
bootstrap_servers=self.bootstrap_servers
)
all_topics = consumer.topics()

with iam

`
from kafka import KafkaConsumer
from aws_msk_iam_sasl_signer import MSKAuthTokenProvider
import socket

class MSKTokenProvider():
def init(self, region_name):
self.region_name = region_name
def token(self):
token, _ = MSKAuthTokenProvider.generate_auth_token(self.region_name)
return token
region_name = {aws_region}
tp = MSKTokenProvider(region_name)

consumer = KafkaConsumer(
bootstrap_servers={server},
security_protocol='SASL_SSL',
sasl_mechanism='OAUTHBEARER',
sasl_oauth_token_provider=tp,
client_id=socket.gethostname()
)
all_topics = consumer.topics()
`

`

Description

compared to SCRAM-SHA-512 , current i am based authentication is very slow, with SCRAM-SHA-512 i am able to list all topics in couple of seconds but with iam its always taking 25 to 40 seconds

What I Did

Paste the command(s) you ran and the output.
If there was a crash, please include the traceback here.

[sankalpbhatia]

Thanks for raising this. Would it be possible to isolate whether it is the client which is taking time to generate the token, or whether it is responses from the server which are delayed?

[sangeethsasidharan]

@sankalpbhatia i can see token is genrating faster, when i directly call tp.token()

consumer = KafkaConsumer( bootstrap_servers='{server}', security_protocol='SASL_SSL', sasl_mechanism='OAUTHBEARER', sasl_oauth_token_provider=tp, client_id=socket.gethostname() )
above also completes in 2 seconds
but this all_topics = consumer.topics() this takes more time , But on user name password authentication everything completes in a second

[sankalpbhatia]

I am afraid I am not able to reproduce this on my local setup. The script you shared works pretty much instantly for me on my Linux client machine.

If you have access to another cluster, would it be possible to check if this issue is isolated to one cluster? If yes, Would it be possible for you to raise an AWS Support Case for this?

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.