Skip to main content
Ascherer17
Ascherer1716-Pearl
16-Pearl
July 17, 2026
Question

IOT Streams, Kafka With Kerberos

  • July 17, 2026
  • 6 replies
  • 75 views

We have a Kafka instance that utilizes Kerberos for authentication, and I want to set up an IOT Stream to push property data to it. I am successfully using Kerberos auth for a database connection from my Thingworx server (RHEL, Thingworx v10.1.1).  Do the Queue Providers support Kerberos authentication at this point?

The Help Center documentation doesn’t provide much guidance on what values I should use in the Configuration of my Queue Provider.  It also seems like the only authentication available is username/password-based.  After some research I tried using “SASL_SSL” for Security Protocol and “GSSAPI” for SASL Mechanism, but I get this error: Save failed: Failed to connect to [MyQP]. Reason: Failed to create new KafkaAdminClient

Any suggestions on getting the Queue Provider to utilize Kerberos authentication for connecting to my Kafka instance?

Help Center reference: https://support.ptc.com/help/thingworx/platform/r10.1/en/index.html#page/ThingWorx/Help/Composer/DataStorage/PersistenceProviders/ConfiguringaQueueProviderEntity.html

 

 

    6 replies

    S
    slangleyCommunity Manager
    Support
    July 28, 2026

    Hi ​@Ascherer17 

    I checked around on this but wasn’t able to get an answer.  I think we’ll need to open a case so I can open a jira with R&D. 

    Please let me know if that is acceptable and I’ll be happy to open the case on your behalf.

    Regards.

    --Sharon

    Ascherer17
    Ascherer1716-PearlAuthor
    16-Pearl
    July 29, 2026

    Yes, we can open a case to make the determination.

    S
    slangleyCommunity Manager
    Support
    July 29, 2026

    Hi @Ascherer17.

    I did find one other resource that may be able to help with this.  I’m waiting for his follow-up, so I’ll hold off on the case until I'm able to assess better whether a case will be needed.

    Regards.

    --Sharon

    Ascherer17
    Ascherer1716-PearlAuthor
    16-Pearl
    July 30, 2026

    Further development:

    After adding settings for the SSL keystore and Trust store and setting SASL mechanism to "GSSAPI/Kerberos", I'm now getting a timeout error in Composer: 

    Save failed: Failed to connect to [<myBootstrapServer:port>]. Reason: org.apache.kafka.common.errors.TimeoutException: Timed out waiting for a node assignment. Call: listNodes

    I also see this WARN message in the Application log:

    [AdminClient clientId=adminclient-28] Error connecting to node <myBootstrapServer:port> (id: -1 rack: null)

    This seems like a step forward as the previous error stated “Failed to create new KafkaAdminClient” while this new WARN suggests an AdminClient was indeed created.  I further found if I change my SASL mechanism back to “GSSAPI”, I get the original  “Failed to create new KafkaAdminClient” error again.

    S
    slangleyCommunity Manager
    Support
    August 3, 2026

    Hi ​@Ascherer17 

    Unfortunately, the R&D resource I talked with advised the code doesn’t support the configuration you’re trying to implement.  It would be an enhancement to the product to add it, so creating a ThingWorx Idea is the best approach forward.

    Regards.

    --Sharon

    Terms & ConditionsAccessibility statement