Share via

Can I connect to event hub with SCRAM_SHA_256? (Java)

max allan 0 Reputation points
2025-08-08T09:12:39.0966667+00:00

Hi, with a producer config like:

bootstrap.servers=example.servicebus.windows.net:9093
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-256
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="$ConnectionString" password="Endpoint=sb://example.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=hahagoodluck=";

I'm unable to connect to Event Hub. But with PLAIN, I can. This works:

bootstrap.servers=example.servicebus.windows.net:9093
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="Endpoint=sb://example.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=hahagoodluck=";

Unfortunately PLAIN auth is not allowed here.

When trying to use SCRAM I get an "EOF" error.

2025-08-08 09:05:38 DEBUG SaslClientAuthenticator:351 - Set SASL client state to RECEIVE_HANDSHAKE_RESPONSE
2025-08-08 09:05:38 DEBUG Selector:607 - [Producer clientId=KafkaExampleProducer] Connection with example.servicebus.windows.net/20.72.245.61 disconnected
java.io.EOFException: EOF during read
at org.apache.kafka.common.network.SslTransportLayer.read(SslTransportLayer.java:581)
at org.apache.kafka.common.network.NetworkReceive.readFrom(NetworkReceive.java:94)
at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.receiveResponseOrToken(SaslClientAuthenticator.java:412)
at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.receiveKafkaResponse(SaslClientAuthenticator.java:502)
at org.apache.kafka.common.security.authenticator.SaslClientAuthenticator.authenticate(SaslClientAuthenticator.java:223)
at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:173)
at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:547)
at org.apache.kafka.common.network.Selector.poll(Selector.java:483)
at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:539)
at org.apache.kafka.clients.producer.internals.Sender.runOnce(Sender.java:331)
at org.apache.kafka.clients.producer.internals.Sender.run(Sender.java:238)
at java.base/java.lang.Thread.run(Thread.java:840)
2025-08-08 09:05:38 DEBUG NetworkClient:882 - [Producer clientId=KafkaExampleProducer] Node -1 disconnected.
2025-08-08 09:05:38 WARN  NetworkClient:741 - [Producer clientId=KafkaExampleProducer] Connection to node -1 (example.servicebus.windows.net/20.82.245.61:9093) terminated during authentication. This may happen due to any of the following reasons: (1) Authentication failed due to invalid credentials with brokers older than 1.0.0, (2) Firewall blocking Kafka TLS traffic (eg it may only allow HTTPS traffic), (3) Transient network issue.
Azure Event Hubs
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Venkat Reddy Navari 5,330 Reputation points Microsoft External Staff Moderator
    2025-08-08T13:58:01.6066667+00:00

    Hi max allan Unfortunately, Azure Event Hubs for Kafka does not support the SCRAM-SHA-256 or SCRAM-SHA-512 SASL mechanisms. The only supported SASL mechanism is PLAIN when connecting via the Kafka protocol.

    Your configuration using SCRAM-SHA-256 will result in errors like the EOFException you're seeing because Event Hubs terminates connections that attempt unsupported authentication methods.

    If PLAIN is not allowed in your environment due to security policies, you might consider the following alternatives:

    • Use Azure Private Link or VNet Integration to secure traffic at the network level while still using PLAIN over SASL_SSL.
    • Consider Azure Managed Identities or OAuth 2.0 authentication if you’re using Event Hubs via native SDKs instead of Kafka protocol.

    For Kafka protocol specifically, Event Hubs currently only allows:

    
security.protocol=SASL_SSL
sasl.mechanism=PLAIN

    More details: Kafka client configuration - Azure Event Hubs

    Hope this helps. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.