OAuth Authentication Fails – “No principal name in JWT claim: sub”

[Sanketbhandare]

Title:

Kafka OAuthBearer authentication fails with "No principal name in JWT claim: sub" when using ForgeRock Identity Platform

Description

I am integrating Kafka (running under Strimzi) with ForgeRock Identity Platform for OAuth2 authentication. Access tokens are issued successfully and look valid when obtained via curl. However, when executing Kafka CLI commands, authentication fails with the following error:

ERROR No principal name in JWT claim: sub
java.io.IOException: No principal name in JWT claim: sub

Error Log

[2025-12-11 14:50:55,008] ERROR No principal name in JWT claim: sub (org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule)
java.io.IOException: No principal name in JWT claim: sub

Environment

• Strimzi version: 0.48.0
• Kafka version: 4.1.0
• Auth provider: ForgeRock Access Management (AM)
• Client tool: Kafka CLI inside Kafka OAuth client pod

ForgeRock Token Request Example (working)

curl -X POST https://<forgerock>/am/oauth2/realms/root/access_token \
-d 'client_id=strimzi-client&client_secret=***&username=KafkaSystemUser&password=***&grant_type=password' \
--cacert forgerock-ca.crt

ForgeRock successfully returns an access token.

Token contains the following user-related claims:

{
"sub": "KafkaSystemUser",
"username": "KafkaSystemUser",
"roles": ["SITKAFKAACCESSROLE"],
...
}

So the sub claim does exist, and Kafka should be able to extract a principal name.

Kafka Admin Properties used

security.protocol=SASL_SSL
sasl.mechanism=OAUTHBEARER
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
oauth.token.endpoint.uri="https://<forgerock>/am/oauth2/realms/root/access_token" \
oauth.client.id="strimzi-client" \
oauth.client.secret="***" \
oauth.principal.claim.name="username";
ssl.truststore.location=/tmp/forgerock-ca.jks
ssl.truststore.password=changeit
ssl.truststore.type=JKS

Command executed

kafka-topics.sh \
--bootstrap-server my-cluster-kafka-bootstrap.strimzi.svc:9094 \
--list \
--command-config /tmp/admin.properties

Expected Behavior

Kafka should accept the JWT and derive the authenticated principal from either:

• "sub" (default), or
• "username" (configured via oauth.principal.claim.name=username).

Either should work because both claims are present.

Actual Behavior

Kafka fails immediately with:
No principal name in JWT claim: sub
Even though the sub claim exists in the token, the OAuthBearer module does not extract it.

What I Have Already Tried

• Verified the JWT structure and claims → everything is valid.
• Changed principal claim name to "sub" and "username" → same error.
• Tested token manually using online JWT decoders → valid and readable.
• Verified ForgeRock CA truststore → working.
• Reproduced inside Kafka OAuth client pod.

Request for Help

• Does Strimzi’s Kafka OAuth support ForgeRock-style JWTs?
• Is there any known issue around principal extraction from sub when using external OAuth2 providers?
• Is there a way to enable deeper debugging for the OAuthBearerLoginModule?
• Are there additional settings required for non-Keycloak identity providers?

Any input or guidance would be greatly appreciated.

If you'd like, I can also add screenshots, token claim samples, or the entire token header/payload (with sensitive values removed).

[mstruk]

oauth.principal.claim.name is not a valid Strimzi OAuth configuration option. You should use oauth.username.claim.

[Sanketbhandare]

Thanks @mstruk , We are now encountering an SSLHandshakeException when running the list nodes command.

We are using ForgeRock deployed on Kubernetes, with an ingress exposing the OAuth endpoint. The certificate used by the ingress is already present in the keystore, but the Kafka client fails during the TLS handshake with the following error:

[2025-12-12 07:26:33,074] ERROR PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule)
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

It appears that the client is not able to build a valid certificate chain when connecting to the ForgeRock token endpoint, even though the ingress certificate has been imported. We suspect this may require importing the full certificate chain (root + intermediate CAs), not only the leaf certificate, but would appreciate guidance on the correct setup for Strimzi OAuth with ForgeRock behind an ingress.

Let us know if additional logs or configuration details are needed.