Reading message fails with SASL_SSL when using consumer groups

[jfancher]

Describe the bug
We have a Kafka cluster configured to use SASL_SSL and SCRAM-SHA-256. Using a Dialer configured with github.com/segmentio/kafka-go/sasl/scram, I am able to:

• Create a topic
• Write a message
• Read the message when not using a consumer group

But when I try to change the reader to use a consumer group, the fetch starts failing with an error originating from scram: server nonce did not extend client nonce

Kafka Version
Kafka 2.1.1

To Reproduce
With a server configured as above:

func main() {
	saslmech, err := scram.Mechanism(scram.SHA256, "my-user", "my-pass")
	if err != nil {
		panic(err)
	}

	dialer := &kafka.Dialer{
		Timeout:       10 * time.Second,
		DualStack:     true,
		SASLMechanism: saslmech,
		TLS: &tls.Config{
			InsecureSkipVerify: true,
		},
	}

	rdr := kafka.NewReader(kafka.ReaderConfig{
		Brokers: []string{"my-broker:9094"},
		Topic:   "my-topic",
		Dialer:  dialer,
		GroupID: "my-group",
	})

	_, err := rdr.FetchMessage(context.Background())
	if err != nil {
		panic(err)
	}
}

This errors on the FetchMessage line with server nonce did not extend client nonce; if I remove the GroupID from the reader config, it reads the message successfully.

[jfancher]

I did a bit more debugging, and have hit upon an important detail -- I am not able to reproduce this against a topic that has only one partition. By adding a Logger I can also see that including a consumer group does some work in parallel per-partition, further indicating some kind of synchronization issue.

[stevevls]

Hi @jfancher. Thanks for the bug report, and the additional info regarding the single topic case. With that extra info, I think you've hit upon a flaw in our SASL implementation--the sasl.Mechanism is stateful, so when you have multiple go routines using the Dialer, they're clobbering each others' stage. I'll have to think on a way to fix it while still preserving API compatibility.

[mcauto]

It still does not seem to support sasl_ssl.