Kafka Exception UnsupportedSaslMechanismException
org.apache.kafka.common.errors.UnsupportedSaslMechanismException
Non-retriable
Security
This exception indicates that the SASL mechanism requested by the client is not enabled on the broker.
Common Causes
- Broker listener is configured with sasl.enabled.mechanisms that does not include the mechanism the client is requesting (e.g., client uses OAUTHBEARER, broker only has PLAIN/SCRAM)
- Client and broker are connecting over the wrong listener port — PLAINTEXT listener used instead of SASL_PLAINTEXT/SASL_SSL
- Broker was upgraded and old SASL mechanism removed from config without updating all clients first
Solutions
- Add the required mechanism to sasl.enabled.mechanisms in server.properties and restart the broker (or rolling restart the cluster)
- Ensure client bootstrap.servers points to the correct SASL listener port; verify with kafka-broker-api-versions.sh
- Align the mechanism in client sasl.mechanism config with what is listed in the broker's sasl.enabled.mechanisms
Example Stack Trace
org.apache.kafka.common.errors.UnsupportedSaslMechanismException: The broker does not support the requested SASL mechanism.Diagnostic Commands
# Verify broker connectivity and API versions
kafka-broker-api-versions.sh --bootstrap-server localhost:9092 --command-config client-sasl.properties 2>&1 | head -5
# Check SASL config in broker properties
grep 'sasl.enabled.mechanisms\|sasl.mechanism' /opt/kafka/config/server.propertiesRelated
Protocol error: UNSUPPORTED_SASL_MECHANISM (code 33)
Related Security exceptions: AuthenticationException · AuthorizationException · AuthorizerNotReadyException · ClusterAuthorizationException · GroupAuthorizationException · IllegalSaslStateException · SaslAuthenticationException · SslAuthenticationException
Hitting
UnsupportedSaslMechanismException in production? Conduktor Console gives you real-time visibility into clients, consumer groups, and broker health. Browse every Kafka exception or protocol error code.