Kafka Error UNSUPPORTED_SASL_MECHANISM
Error code 33 · Non-retriable Security
The broker does not support the requested SASL mechanism.
Common Causes
- Broker listener is configured with sasl.enabled.mechanisms that does not include the mechanism the client is requesting (e.g., client uses OAUTHBEARER, broker only has PLAIN/SCRAM)
- Client and broker are connecting over the wrong listener port — PLAINTEXT listener used instead of SASL_PLAINTEXT/SASL_SSL
- Broker was upgraded and old SASL mechanism removed from config without updating all clients first
Solutions
- Add the required mechanism to sasl.enabled.mechanisms in server.properties and restart the broker (or rolling restart the cluster)
- Ensure client bootstrap.servers points to the correct SASL listener port; verify with kafka-broker-api-versions.sh
- Align the mechanism in client sasl.mechanism config with what is listed in the broker's sasl.enabled.mechanisms
Diagnostic Commands
# Verify broker connectivity and API versions
kafka-broker-api-versions.sh --bootstrap-server localhost:9092 --command-config client-sasl.properties 2>&1 | head -5
# Check SASL config in broker properties
grep 'sasl.enabled.mechanisms\|sasl.mechanism' /opt/kafka/config/server.propertiesRelated APIs
This error can be returned by: SaslHandshake
Debugging Kafka errors? Conduktor Console gives you real-time visibility into your cluster. Explore all errors in the Error Decoder.