[2026-07-11 03:46:01,352] INFO Registered `kafka:type=kafka.Log4jController` MBean (kafka.utils.Log4jControllerRegistration$) [2026-07-11 03:46:01,550] INFO Registered signal handlers for TERM, INT, HUP (org.apache.kafka.common.utils.LoggingSignalHandler) [2026-07-11 03:46:01,552] INFO [ControllerServer id=0] Starting controller (kafka.server.ControllerServer) [2026-07-11 03:46:01,723] INFO Updated connection-accept-rate max connection creation rate to 2147483647 (kafka.network.ConnectionQuotas) [2026-07-11 03:46:01,746] INFO [SocketServer listenerType=CONTROLLER, nodeId=0] Created data-plane acceptor and processors for endpoint : ListenerName(CONTROLLER) (kafka.network.SocketServer) [2026-07-11 03:46:01,749] INFO authorizerStart completed for endpoint CONTROLLER. Endpoint is now READY. (org.apache.kafka.server.network.EndpointReadyFutures) [2026-07-11 03:46:01,750] INFO [SharedServer id=0] Starting SharedServer (kafka.server.SharedServer) [2026-07-11 03:46:01,777] INFO [LogLoader partition=__cluster_metadata-0, dir=/tmp/kafka-oauth-repro/data_secured] Loading producer state till offset 0 (org.apache.kafka.storage.internals.log.UnifiedLog) [2026-07-11 03:46:01,778] INFO [LogLoader partition=__cluster_metadata-0, dir=/tmp/kafka-oauth-repro/data_secured] Reloading from producer snapshot and rebuilding producer state from offset 0 (org.apache.kafka.storage.internals.log.UnifiedLog) [2026-07-11 03:46:01,778] INFO [LogLoader partition=__cluster_metadata-0, dir=/tmp/kafka-oauth-repro/data_secured] Producer state recovery took 0ms for snapshot load and 0ms for segment recovery from offset 0 (org.apache.kafka.storage.internals.log.UnifiedLog) [2026-07-11 03:46:01,782] INFO [RaftLog partition=__cluster_metadata-0] Initialized snapshots with IDs [] from /tmp/kafka-oauth-repro/data_secured/__cluster_metadata-0 (org.apache.kafka.raft.internals.KafkaRaftLog) [2026-07-11 03:46:01,788] INFO [raft-expiration-reaper]: Starting (org.apache.kafka.raft.TimingWheelExpirationService$ExpiredOperationReaper) [2026-07-11 03:46:01,794] INFO [RaftManager id=0] Reading KRaft snapshot and log as part of the initialization (org.apache.kafka.raft.KafkaRaftClient) [2026-07-11 03:46:01,796] INFO [RaftManager id=0] Starting voters are VoterSet(voters={0=VoterNode(voterKey=ReplicaKey(id=0, directoryId=), listeners=Endpoints(endpoints={ListenerName(CONTROLLER)=127.0.0.1/:9093}), supportedKRaftVersion=SupportedVersionRange[min_version:0, max_version:0])}) (org.apache.kafka.raft.KafkaRaftClient) [2026-07-11 03:46:01,799] INFO [RaftManager id=0] Starting request manager with static voters: [127.0.0.1:9093 (id: 0 rack: null isFenced: false)] (org.apache.kafka.raft.KafkaRaftClient) [2026-07-11 03:46:01,801] INFO [RaftManager id=0] Attempting durable transition to UnattachedState(epoch=0, leaderId=OptionalInt.empty, votedKey=Optional.empty, voters=[0], electionTimeoutMs=1880, highWatermark=Optional.empty) from null (org.apache.kafka.raft.QuorumState) [2026-07-11 03:46:01,818] INFO [RaftManager id=0] Completed transition to UnattachedState(epoch=0, leaderId=OptionalInt.empty, votedKey=Optional.empty, voters=[0], electionTimeoutMs=1880, highWatermark=Optional.empty) from null (org.apache.kafka.raft.QuorumState) [2026-07-11 03:46:01,824] INFO [RaftManager id=0] Completed transition to ProspectiveState(epoch=0, leaderId=OptionalInt.empty, votedKey=Optional.empty, epochElection=EpochElection[voterStates={0=VoterState(replicaKey=ReplicaKey(id=0, directoryId=), state=GRANTED)}], electionTimeoutMs=1704, highWatermark=Optional.empty) from UnattachedState(epoch=0, leaderId=OptionalInt.empty, votedKey=Optional.empty, voters=[0], electionTimeoutMs=1880, highWatermark=Optional.empty) (org.apache.kafka.raft.QuorumState) [2026-07-11 03:46:01,825] INFO [RaftManager id=0] Attempting durable transition to CandidateState(localId=0, localDirectoryId=7FQqY3yjJbNLuejwmagf9A, epoch=1, epochElection=EpochElection[voterStates={0=VoterState(replicaKey=ReplicaKey(id=0, directoryId=), state=GRANTED)}], highWatermark=Optional.empty, electionTimeoutMs=1397) from ProspectiveState(epoch=0, leaderId=OptionalInt.empty, votedKey=Optional.empty, epochElection=EpochElection[voterStates={0=VoterState(replicaKey=ReplicaKey(id=0, directoryId=), state=GRANTED)}], electionTimeoutMs=1704, highWatermark=Optional.empty) (org.apache.kafka.raft.QuorumState) [2026-07-11 03:46:01,836] INFO [RaftManager id=0] Completed transition to CandidateState(localId=0, localDirectoryId=7FQqY3yjJbNLuejwmagf9A, epoch=1, epochElection=EpochElection[voterStates={0=VoterState(replicaKey=ReplicaKey(id=0, directoryId=), state=GRANTED)}], highWatermark=Optional.empty, electionTimeoutMs=1397) from ProspectiveState(epoch=0, leaderId=OptionalInt.empty, votedKey=Optional.empty, epochElection=EpochElection[voterStates={0=VoterState(replicaKey=ReplicaKey(id=0, directoryId=), state=GRANTED)}], electionTimeoutMs=1704, highWatermark=Optional.empty) (org.apache.kafka.raft.QuorumState) [2026-07-11 03:46:01,839] INFO [RaftManager id=0] Attempting durable transition to Leader(localVoterNode=VoterNode(voterKey=ReplicaKey(id=0, directoryId=7FQqY3yjJbNLuejwmagf9A), listeners=Endpoints(endpoints={ListenerName(CONTROLLER)=127.0.0.1/:9093}), supportedKRaftVersion=SupportedVersionRange[min_version:0, max_version:1]), epoch=1, epochStartOffset=0, highWatermark=Optional.empty, voterStates={0=ReplicaState(replicaKey=ReplicaKey(id=0, directoryId=), endOffset=Optional.empty, lastFetchTimestamp=-1, lastCaughtUpTimestamp=-1, hasAcknowledgedLeader=true)}) from CandidateState(localId=0, localDirectoryId=7FQqY3yjJbNLuejwmagf9A, epoch=1, epochElection=EpochElection[voterStates={0=VoterState(replicaKey=ReplicaKey(id=0, directoryId=), state=GRANTED)}], highWatermark=Optional.empty, electionTimeoutMs=1397) (org.apache.kafka.raft.QuorumState) [2026-07-11 03:46:01,848] INFO [RaftManager id=0] Completed transition to Leader(localVoterNode=VoterNode(voterKey=ReplicaKey(id=0, directoryId=7FQqY3yjJbNLuejwmagf9A), listeners=Endpoints(endpoints={ListenerName(CONTROLLER)=127.0.0.1/:9093}), supportedKRaftVersion=SupportedVersionRange[min_version:0, max_version:1]), epoch=1, epochStartOffset=0, highWatermark=Optional.empty, voterStates={0=ReplicaState(replicaKey=ReplicaKey(id=0, directoryId=), endOffset=Optional.empty, lastFetchTimestamp=-1, lastCaughtUpTimestamp=-1, hasAcknowledgedLeader=true)}) from CandidateState(localId=0, localDirectoryId=7FQqY3yjJbNLuejwmagf9A, epoch=1, epochElection=EpochElection[voterStates={0=VoterState(replicaKey=ReplicaKey(id=0, directoryId=), state=GRANTED)}], highWatermark=Optional.empty, electionTimeoutMs=1397) (org.apache.kafka.raft.QuorumState) [2026-07-11 03:46:01,866] INFO [kafka-0-raft-io-thread]: Starting (org.apache.kafka.raft.KafkaRaftClientDriver) [2026-07-11 03:46:01,866] INFO [kafka-0-raft-outbound-request-thread]: Starting (org.apache.kafka.raft.KafkaNetworkChannel$SendThread) [2026-07-11 03:46:01,880] INFO [MetadataLoader id=0] initializeNewPublishers: The loader is still catching up because we have loaded up to offset -1, but the high water mark is 1 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,880] INFO [ControllerServer id=0] Waiting for controller quorum voters future (kafka.server.ControllerServer) [2026-07-11 03:46:01,880] INFO [ControllerServer id=0] Finished waiting for controller quorum voters future (kafka.server.ControllerServer) [2026-07-11 03:46:01,882] INFO [RaftManager id=0] High watermark set to LogOffsetMetadata(offset=1, metadata=Optional[(segmentBaseOffset=0,relativePositionInSegment=91)]) for the first time for epoch 1 based on indexOfHw 0 and voters [ReplicaState(replicaKey=ReplicaKey(id=0, directoryId=), endOffset=Optional[LogOffsetMetadata(offset=1, metadata=Optional[(segmentBaseOffset=0,relativePositionInSegment=91)])], lastFetchTimestamp=-1, lastCaughtUpTimestamp=-1, hasAcknowledgedLeader=true)] (org.apache.kafka.raft.LeaderState) [2026-07-11 03:46:01,900] INFO [controller-0-ThrottledChannelReaper-Fetch]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,901] INFO [controller-0-ThrottledChannelReaper-Produce]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,901] INFO [controller-0-ThrottledChannelReaper-Request]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,902] INFO [RaftManager id=0] Registered the listener org.apache.kafka.image.loader.MetadataLoader@2064430782 (org.apache.kafka.raft.KafkaRaftClient) [2026-07-11 03:46:01,902] INFO [controller-0-ThrottledChannelReaper-ControllerMutation]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,902] INFO [RaftManager id=0] Registered the listener org.apache.kafka.controller.QuorumController$QuorumMetaLogListener@108607227 (org.apache.kafka.raft.KafkaRaftClient) [2026-07-11 03:46:01,902] INFO [RaftManager id=0] Setting the next offset of org.apache.kafka.controller.QuorumController$QuorumMetaLogListener@108607227 to 0 since there are no snapshots (org.apache.kafka.raft.KafkaRaftClient) [2026-07-11 03:46:01,903] INFO [RaftManager id=0] Setting the next offset of org.apache.kafka.image.loader.MetadataLoader@2064430782 to 0 since there are no snapshots (org.apache.kafka.raft.KafkaRaftClient) [2026-07-11 03:46:01,904] INFO [MetadataLoader id=0] maybePublishMetadata(LOG_DELTA): The loader is still catching up because we have not loaded a controller record as of offset 0 and high water mark is 1 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,911] INFO [ExpirationReaper-0-AlterAcls]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:01,921] INFO [ControllerServer id=0] Waiting for the controller metadata publishers to be installed (kafka.server.ControllerServer) [2026-07-11 03:46:01,921] INFO [ControllerServer id=0] Finished waiting for the controller metadata publishers to be installed (kafka.server.ControllerServer) [2026-07-11 03:46:01,921] INFO [MetadataLoader id=0] initializeNewPublishers: The loader is still catching up because we have not loaded a controller record as of offset 0 and high water mark is 1 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,922] INFO [SocketServer listenerType=CONTROLLER, nodeId=0] Enabling request processing. (kafka.network.SocketServer) [2026-07-11 03:46:01,924] INFO Awaiting socket connections on 127.0.0.1:9093. (kafka.network.DataPlaneAcceptor) [2026-07-11 03:46:01,937] INFO [controller-0-to-controller-registration-channel-manager]: Starting (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:01,938] INFO [ControllerServer id=0] Waiting for all of the authorizer futures to be completed (kafka.server.ControllerServer) [2026-07-11 03:46:01,938] INFO Recorded new KRaft controller, from now on will use node 127.0.0.1:9093 (id: 0 rack: null isFenced: false) (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:01,938] INFO [ControllerServer id=0] Finished waiting for all of the authorizer futures to be completed (kafka.server.ControllerServer) [2026-07-11 03:46:01,938] INFO [ControllerServer id=0] Waiting for all of the SocketServer Acceptors to be started (kafka.server.ControllerServer) [2026-07-11 03:46:01,938] INFO [ControllerServer id=0] Finished waiting for all of the SocketServer Acceptors to be started (kafka.server.ControllerServer) [2026-07-11 03:46:01,938] INFO [ControllerRegistrationManager id=0 incarnation=ueoTdGPKRs6hH2ye4codPQ] initialized channel manager. (kafka.server.ControllerRegistrationManager) [2026-07-11 03:46:01,938] INFO [ControllerRegistrationManager id=0 incarnation=ueoTdGPKRs6hH2ye4codPQ] maybeSendControllerRegistration: cannot register yet because the metadata.version is not known yet. (kafka.server.ControllerRegistrationManager) [2026-07-11 03:46:01,939] INFO [BrokerServer id=0] Transition from SHUTDOWN to STARTING (kafka.server.BrokerServer) [2026-07-11 03:46:01,939] INFO [BrokerServer id=0] Starting broker (kafka.server.BrokerServer) [2026-07-11 03:46:01,943] INFO [broker-0-ThrottledChannelReaper-Fetch]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,943] INFO [broker-0-ThrottledChannelReaper-Request]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,943] INFO [broker-0-ThrottledChannelReaper-Produce]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,944] INFO [broker-0-ThrottledChannelReaper-ControllerMutation]: Starting (org.apache.kafka.server.quota.ClientQuotaManager$ThrottledChannelReaper) [2026-07-11 03:46:01,946] INFO [MetadataLoader id=0] maybePublishMetadata(LOG_DELTA): The loader finished catching up to the current high water mark of 10 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,947] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing SnapshotGenerator with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,948] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing KRaftMetadataCachePublisher with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,948] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing FeaturesPublisher with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,950] INFO [ControllerServer id=0] Loaded new metadata FinalizedFeatures[metadataVersion=4.3-IV0, finalizedFeatures={group.version=1, streams.version=1, transaction.version=2, eligible.leader.replicas.version=1, share.version=1, metadata.version=30}, finalizedFeaturesEpoch=9]. (org.apache.kafka.metadata.publisher.FeaturesPublisher) [2026-07-11 03:46:01,950] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing ControllerRegistrationsPublisher with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,950] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing ControllerRegistrationManager with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,950] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing DynamicConfigPublisher controller id=0 with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,954] INFO [DynamicConfigPublisher controller id=0] Updating cluster configuration : min.insync.replicas -> 1 (kafka.server.metadata.DynamicConfigPublisher) [2026-07-11 03:46:01,955] INFO [ControllerRegistrationManager id=0 incarnation=ueoTdGPKRs6hH2ye4codPQ] sendControllerRegistration: attempting to send ControllerRegistrationRequestData(controllerId=0, incarnationId=ueoTdGPKRs6hH2ye4codPQ, zkMigrationReady=false, listeners=[Listener(name='CONTROLLER', host='127.0.0.1', port=9093, securityProtocol=0)], features=[Feature(name='group.version', minSupportedVersion=0, maxSupportedVersion=1), Feature(name='kraft.version', minSupportedVersion=0, maxSupportedVersion=1), Feature(name='metadata.version', minSupportedVersion=7, maxSupportedVersion=30), Feature(name='share.version', minSupportedVersion=0, maxSupportedVersion=1), Feature(name='streams.version', minSupportedVersion=0, maxSupportedVersion=1), Feature(name='transaction.version', minSupportedVersion=0, maxSupportedVersion=2), Feature(name='eligible.leader.replicas.version', minSupportedVersion=0, maxSupportedVersion=1)]) (kafka.server.ControllerRegistrationManager) [2026-07-11 03:46:01,956] INFO AbstractConfig values: group.consumer.assignment.interval.ms = 1000 group.consumer.assignors = [uniform, range] group.consumer.heartbeat.interval.ms = 5000 group.consumer.max.assignment.interval.ms = 15000 group.consumer.max.heartbeat.interval.ms = 15000 group.consumer.max.session.timeout.ms = 60000 group.consumer.max.size = 2147483647 group.consumer.migration.policy = bidirectional group.consumer.min.assignment.interval.ms = 0 group.consumer.min.heartbeat.interval.ms = 5000 group.consumer.min.session.timeout.ms = 45000 group.consumer.regex.refresh.interval.ms = 600000 group.consumer.session.timeout.ms = 45000 group.coordinator.append.linger.ms = -1 group.coordinator.background.threads = 2 group.coordinator.cached.buffer.max.bytes = 1048588 group.coordinator.rebalance.protocols = [classic, consumer, streams] group.coordinator.threads = 4 group.initial.rebalance.delay.ms = 3000 group.max.session.timeout.ms = 1800000 group.max.size = 2147483647 group.min.session.timeout.ms = 6000 group.share.assignment.interval.ms = 1000 group.share.assignors = [simple] group.share.heartbeat.interval.ms = 5000 group.share.initialize.retry.interval.ms = 30000 group.share.max.assignment.interval.ms = 15000 group.share.max.heartbeat.interval.ms = 15000 group.share.max.session.timeout.ms = 60000 group.share.max.size = 200 group.share.min.assignment.interval.ms = 0 group.share.min.heartbeat.interval.ms = 5000 group.share.min.session.timeout.ms = 45000 group.share.session.timeout.ms = 45000 group.streams.assignment.interval.ms = 1000 group.streams.heartbeat.interval.ms = 5000 group.streams.initial.rebalance.delay.ms = 3000 group.streams.max.assignment.interval.ms = 15000 group.streams.max.heartbeat.interval.ms = 15000 group.streams.max.session.timeout.ms = 60000 group.streams.max.size = 2147483647 group.streams.max.standby.replicas = 2 group.streams.min.assignment.interval.ms = 0 group.streams.min.heartbeat.interval.ms = 5000 group.streams.min.session.timeout.ms = 45000 group.streams.num.standby.replicas = 0 group.streams.session.timeout.ms = 45000 offset.metadata.max.bytes = 4096 offsets.commit.timeout.ms = 5000 offsets.load.buffer.size = 5242880 offsets.retention.check.interval.ms = 600000 offsets.retention.minutes = 10080 offsets.topic.compression.codec = 0 offsets.topic.num.partitions = 50 offsets.topic.replication.factor = 1 offsets.topic.segment.bytes = 104857600 (org.apache.kafka.common.config.AbstractConfig) [2026-07-11 03:46:01,956] INFO KafkaConfig values: add.partitions.to.txn.retry.backoff.max.ms = 100 add.partitions.to.txn.retry.backoff.ms = 20 advertised.listeners = [SASL_PLAINTEXT://127.0.0.1:9092] alter.config.policy.class.name = null alter.log.dirs.replication.quota.window.num = 11 alter.log.dirs.replication.quota.window.size.seconds = 1 authorizer.class.name = auto.create.topics.enable = true auto.leader.rebalance.enable = true background.threads = 10 broker.heartbeat.interval.ms = 2000 broker.id = 0 broker.rack = null broker.session.timeout.ms = 9000 client.quota.callback.class = null compression.gzip.level = -1 compression.lz4.level = 9 compression.type = producer compression.zstd.level = 3 config.providers = [] connection.failed.authentication.delay.ms = 100 connections.max.idle.ms = 600000 connections.max.reauth.ms = 0 controlled.shutdown.enable = true controller.listener.names = [CONTROLLER] controller.performance.always.log.threshold.ms = 2000 controller.performance.sample.period.ms = 60000 controller.quorum.append.linger.ms = 25 controller.quorum.auto.join.enable = false controller.quorum.bootstrap.servers = [] controller.quorum.election.backoff.max.ms = 1000 controller.quorum.election.timeout.ms = 1000 controller.quorum.fetch.max.bytes = 1048576 controller.quorum.fetch.snapshot.max.bytes = 1048576 controller.quorum.fetch.timeout.ms = 2000 controller.quorum.request.timeout.ms = 2000 controller.quorum.retry.backoff.ms = 20 controller.quorum.voters = [0@127.0.0.1:9093] controller.quota.window.num = 11 controller.quota.window.size.seconds = 1 controller.socket.timeout.ms = 30000 cordoned.log.dirs = [] create.topic.policy.class.name = null default.replication.factor = 1 delegation.token.expiry.check.interval.ms = 3600000 delegation.token.expiry.time.ms = 86400000 delegation.token.max.lifetime.ms = 604800000 delegation.token.secret.key = null delete.records.purgatory.purge.interval.requests = 1 delete.topic.enable = true early.start.listeners = null fetch.max.bytes = 57671680 fetch.purgatory.purge.interval.requests = 1000 follower.fetch.last.tiered.offset.enable = false group.consumer.assignment.interval.ms = 1000 group.consumer.assignors = [uniform, range] group.consumer.heartbeat.interval.ms = 5000 group.consumer.max.assignment.interval.ms = 15000 group.consumer.max.heartbeat.interval.ms = 15000 group.consumer.max.session.timeout.ms = 60000 group.consumer.max.size = 2147483647 group.consumer.migration.policy = bidirectional group.consumer.min.assignment.interval.ms = 0 group.consumer.min.heartbeat.interval.ms = 5000 group.consumer.min.session.timeout.ms = 45000 group.consumer.regex.refresh.interval.ms = 600000 group.consumer.session.timeout.ms = 45000 group.coordinator.append.linger.ms = -1 group.coordinator.background.threads = 2 group.coordinator.cached.buffer.max.bytes = 1048588 group.coordinator.rebalance.protocols = [classic, consumer, streams] group.coordinator.threads = 4 group.initial.rebalance.delay.ms = 3000 group.max.session.timeout.ms = 1800000 group.max.size = 2147483647 group.min.session.timeout.ms = 6000 group.share.assignment.interval.ms = 1000 group.share.assignors = [simple] group.share.delivery.count.limit = 5 group.share.heartbeat.interval.ms = 5000 group.share.initialize.retry.interval.ms = 30000 group.share.max.assignment.interval.ms = 15000 group.share.max.delivery.count.limit = 10 group.share.max.heartbeat.interval.ms = 15000 group.share.max.partition.max.record.locks = 4000 group.share.max.record.lock.duration.ms = 60000 group.share.max.session.timeout.ms = 60000 group.share.max.share.sessions = 2000 group.share.max.size = 200 group.share.min.assignment.interval.ms = 0 group.share.min.delivery.count.limit = 2 group.share.min.heartbeat.interval.ms = 5000 group.share.min.partition.max.record.locks = 100 group.share.min.record.lock.duration.ms = 15000 group.share.min.session.timeout.ms = 45000 group.share.partition.max.record.locks = 2000 group.share.persister.class.name = org.apache.kafka.server.share.persister.DefaultStatePersister group.share.record.lock.duration.ms = 30000 group.share.session.timeout.ms = 45000 group.streams.assignment.interval.ms = 1000 group.streams.heartbeat.interval.ms = 5000 group.streams.initial.rebalance.delay.ms = 3000 group.streams.max.assignment.interval.ms = 15000 group.streams.max.heartbeat.interval.ms = 15000 group.streams.max.session.timeout.ms = 60000 group.streams.max.size = 2147483647 group.streams.max.standby.replicas = 2 group.streams.min.assignment.interval.ms = 0 group.streams.min.heartbeat.interval.ms = 5000 group.streams.min.session.timeout.ms = 45000 group.streams.num.standby.replicas = 0 group.streams.session.timeout.ms = 45000 initial.broker.registration.timeout.ms = 60000 inter.broker.listener.name = SASL_PLAINTEXT internal.metadata.delete.delay.millis = 60000 internal.metadata.log.segment.bytes = null internal.metadata.max.batch.size.in.bytes = 8388608 kafka.metrics.polling.interval.secs = 10 kafka.metrics.reporters = [] leader.imbalance.check.interval.seconds = 300 listener.security.protocol.map = SASL_PLAINTEXT:SASL_PLAINTEXT,CONTROLLER:PLAINTEXT listeners = [SASL_PLAINTEXT://127.0.0.1:9092, CONTROLLER://127.0.0.1:9093] log.cleaner.backoff.ms = 15000 log.cleaner.dedupe.buffer.size = 134217728 log.cleaner.delete.retention.ms = 86400000 log.cleaner.enable = true log.cleaner.io.buffer.load.factor = 0.9 log.cleaner.io.buffer.size = 524288 log.cleaner.io.max.bytes.per.second = 1.7976931348623157E308 log.cleaner.max.compaction.lag.ms = 9223372036854775807 log.cleaner.min.cleanable.ratio = 0.5 log.cleaner.min.compaction.lag.ms = 0 log.cleaner.threads = 1 log.cleanup.policy = [delete] log.dir = [/tmp/kafka-logs] log.dir.failure.timeout.ms = 30000 log.dirs = [/tmp/kafka-oauth-repro/data_secured] log.flush.interval.messages = 9223372036854775807 log.flush.interval.ms = null log.flush.offset.checkpoint.interval.ms = 60000 log.flush.scheduler.interval.ms = 9223372036854775807 log.flush.start.offset.checkpoint.interval.ms = 60000 log.index.interval.bytes = 4096 log.index.size.max.bytes = 10485760 log.initial.task.delay.ms = 30000 log.local.retention.bytes = -2 log.local.retention.ms = -2 log.message.timestamp.after.max.ms = 3600000 log.message.timestamp.before.max.ms = 9223372036854775807 log.message.timestamp.type = CreateTime log.preallocate = false log.retention.bytes = -1 log.retention.check.interval.ms = 300000 log.retention.hours = 168 log.retention.minutes = null log.retention.ms = null log.roll.hours = 168 log.roll.jitter.hours = 0 log.roll.jitter.ms = null log.roll.ms = null log.segment.bytes = 1073741824 log.segment.delete.delay.ms = 60000 max.connection.creation.rate = 2147483647 max.connections = 2147483647 max.connections.per.ip = 2147483647 max.connections.per.ip.overrides = max.incremental.fetch.session.cache.slots = 1000 max.request.partition.size.limit = 2000 message.max.bytes = 1048588 metadata.log.dir = null metadata.log.max.record.bytes.between.snapshots = 20971520 metadata.log.max.snapshot.interval.ms = 3600000 metadata.log.segment.bytes = 1073741824 metadata.log.segment.ms = 604800000 metadata.max.idle.interval.ms = 500 metadata.max.retention.bytes = 104857600 metadata.max.retention.ms = 604800000 metric.reporters = [org.apache.kafka.common.metrics.JmxReporter] metrics.num.samples = 2 metrics.recording.level = INFO metrics.sample.window.ms = 30000 min.insync.replicas = 1 node.id = 0 num.io.threads = 8 num.network.threads = 3 num.partitions = 1 num.recovery.threads.per.data.dir = 2 num.replica.alter.log.dirs.threads = null num.replica.fetchers = 1 offset.metadata.max.bytes = 4096 offsets.commit.timeout.ms = 5000 offsets.load.buffer.size = 5242880 offsets.retention.check.interval.ms = 600000 offsets.retention.minutes = 10080 offsets.topic.compression.codec = 0 offsets.topic.num.partitions = 50 offsets.topic.replication.factor = 1 offsets.topic.segment.bytes = 104857600 principal.builder.class = class org.apache.kafka.common.security.authenticator.DefaultKafkaPrincipalBuilder process.roles = [broker, controller] producer.id.expiration.check.interval.ms = 600000 producer.id.expiration.ms = 86400000 producer.purgatory.purge.interval.requests = 1000 queued.max.request.bytes = -1 queued.max.requests = 500 quota.window.num = 11 quota.window.size.seconds = 1 remote.fetch.max.wait.ms = 500 remote.list.offsets.request.timeout.ms = 30000 remote.log.index.file.cache.total.size.bytes = 1073741824 remote.log.index.file.cache.ttl.ms = 900000 remote.log.manager.copier.thread.pool.size = 10 remote.log.manager.copy.max.bytes.per.second = 9223372036854775807 remote.log.manager.copy.quota.window.num = 11 remote.log.manager.copy.quota.window.size.seconds = 1 remote.log.manager.expiration.thread.pool.size = 10 remote.log.manager.fetch.max.bytes.per.second = 9223372036854775807 remote.log.manager.fetch.quota.window.num = 11 remote.log.manager.fetch.quota.window.size.seconds = 1 remote.log.manager.follower.thread.pool.size = 2 remote.log.manager.task.interval.ms = 30000 remote.log.manager.task.retry.backoff.max.ms = 30000 remote.log.manager.task.retry.backoff.ms = 500 remote.log.manager.task.retry.jitter = 0.2 remote.log.manager.thread.pool.size = 2 remote.log.metadata.custom.metadata.max.bytes = 128 remote.log.metadata.manager.class.name = org.apache.kafka.server.log.remote.metadata.storage.TopicBasedRemoteLogMetadataManager remote.log.metadata.manager.class.path = null remote.log.metadata.manager.impl.prefix = rlmm.config. remote.log.metadata.manager.listener.name = null remote.log.reader.max.pending.tasks = 100 remote.log.reader.threads = 10 remote.log.storage.manager.class.name = null remote.log.storage.manager.class.path = null remote.log.storage.manager.impl.prefix = rsm.config. remote.log.storage.system.enable = false replica.fetch.backoff.ms = 1000 replica.fetch.max.bytes = 1048576 replica.fetch.min.bytes = 1 replica.fetch.response.max.bytes = 10485760 replica.fetch.wait.max.ms = 500 replica.high.watermark.checkpoint.interval.ms = 5000 replica.lag.time.max.ms = 30000 replica.selector.class = null replica.socket.receive.buffer.bytes = 65536 replica.socket.timeout.ms = 30000 replication.quota.window.num = 11 replication.quota.window.size.seconds = 1 request.timeout.ms = 30000 sasl.client.callback.handler.class = null sasl.enabled.mechanisms = [OAUTHBEARER] sasl.jaas.config = null sasl.kerberos.kinit.cmd = /usr/bin/kinit sasl.kerberos.min.time.before.relogin = 60000 sasl.kerberos.principal.to.local.rules = [DEFAULT] sasl.kerberos.service.name = null sasl.kerberos.ticket.renew.jitter = 0.05 sasl.kerberos.ticket.renew.window.factor = 0.8 sasl.login.callback.handler.class = null sasl.login.class = null sasl.login.connect.timeout.ms = null sasl.login.read.timeout.ms = null sasl.login.refresh.buffer.seconds = 300 sasl.login.refresh.min.period.seconds = 60 sasl.login.refresh.window.factor = 0.8 sasl.login.refresh.window.jitter = 0.05 sasl.login.retry.backoff.max.ms = 10000 sasl.login.retry.backoff.ms = 100 sasl.mechanism.controller.protocol = GSSAPI sasl.mechanism.inter.broker.protocol = OAUTHBEARER sasl.oauthbearer.assertion.algorithm = RS256 sasl.oauthbearer.assertion.claim.aud = null sasl.oauthbearer.assertion.claim.exp.seconds = 300 sasl.oauthbearer.assertion.claim.iss = null sasl.oauthbearer.assertion.claim.jti.include = false sasl.oauthbearer.assertion.claim.nbf.seconds = 60 sasl.oauthbearer.assertion.claim.sub = null sasl.oauthbearer.assertion.file = null sasl.oauthbearer.assertion.private.key.file = null sasl.oauthbearer.assertion.private.key.passphrase = null sasl.oauthbearer.assertion.template.file = null sasl.oauthbearer.client.credentials.client.id = valid-broker sasl.oauthbearer.client.credentials.client.secret = [hidden] sasl.oauthbearer.clock.skew.seconds = 30 sasl.oauthbearer.expected.audience = [kafka-broker] sasl.oauthbearer.expected.issuer = https://mock-idp.example.com sasl.oauthbearer.jwks.endpoint.refresh.ms = 3600000 sasl.oauthbearer.jwks.endpoint.retry.backoff.max.ms = 10000 sasl.oauthbearer.jwks.endpoint.retry.backoff.ms = 100 sasl.oauthbearer.jwks.endpoint.url = null sasl.oauthbearer.jwt.retriever.class = class org.apache.kafka.common.security.oauthbearer.DefaultJwtRetriever sasl.oauthbearer.jwt.validator.class = class org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator sasl.oauthbearer.scope = null sasl.oauthbearer.scope.claim.name = scope sasl.oauthbearer.sub.claim.name = sub sasl.oauthbearer.token.endpoint.url = http://127.0.0.1:8080/token sasl.server.callback.handler.class = null sasl.server.max.receive.size = 524288 security.inter.broker.protocol = PLAINTEXT security.providers = null server.max.startup.time.ms = 9223372036854775807 share.coordinator.append.linger.ms = -1 share.coordinator.cached.buffer.max.bytes = 1048588 share.coordinator.cold.partition.snapshot.interval.ms = 300000 share.coordinator.load.buffer.size = 5242880 share.coordinator.snapshot.update.records.per.snapshot = 500 share.coordinator.state.topic.compression.codec = 0 share.coordinator.state.topic.min.isr = 2 share.coordinator.state.topic.num.partitions = 50 share.coordinator.state.topic.prune.interval.ms = 300000 share.coordinator.state.topic.replication.factor = 3 share.coordinator.state.topic.segment.bytes = 104857600 share.coordinator.threads = 1 share.coordinator.write.timeout.ms = 5000 share.fetch.purgatory.purge.interval.requests = 1000 socket.connection.setup.timeout.max.ms = 30000 socket.connection.setup.timeout.ms = 10000 socket.listen.backlog.size = 50 socket.receive.buffer.bytes = 102400 socket.request.max.bytes = 104857600 socket.send.buffer.bytes = 102400 ssl.allow.dn.changes = false ssl.allow.san.changes = false ssl.cipher.suites = [] ssl.client.auth = none ssl.enabled.protocols = [TLSv1.2, TLSv1.3] ssl.endpoint.identification.algorithm = https ssl.engine.factory.class = null ssl.key.password = null ssl.keymanager.algorithm = SunX509 ssl.keystore.certificate.chain = null ssl.keystore.key = null ssl.keystore.location = null ssl.keystore.password = null ssl.keystore.type = JKS ssl.principal.mapping.rules = DEFAULT ssl.protocol = TLSv1.3 ssl.provider = null ssl.secure.random.implementation = null ssl.trustmanager.algorithm = PKIX ssl.truststore.certificates = null ssl.truststore.location = null ssl.truststore.password = null ssl.truststore.type = JKS telemetry.max.bytes = 1048576 transaction.abort.timed.out.transaction.cleanup.interval.ms = 10000 transaction.max.timeout.ms = 900000 transaction.partition.verification.enable = true transaction.remove.expired.transaction.cleanup.interval.ms = 3600000 transaction.state.log.load.buffer.size = 5242880 transaction.state.log.min.isr = 1 transaction.state.log.num.partitions = 50 transaction.state.log.replication.factor = 1 transaction.state.log.segment.bytes = 104857600 transaction.two.phase.commit.enable = false transactional.id.expiration.ms = 604800000 unclean.leader.election.enable = false unclean.leader.election.interval.ms = 300000 unstable.api.versions.enable = false unstable.feature.versions.enable = false (org.apache.kafka.common.config.AbstractConfig) [2026-07-11 03:46:01,959] INFO [BrokerServer id=0] Waiting for controller quorum voters future (kafka.server.BrokerServer) [2026-07-11 03:46:01,959] INFO [BrokerServer id=0] Finished waiting for controller quorum voters future (kafka.server.BrokerServer) [2026-07-11 03:46:01,960] INFO [broker-0-to-controller-forwarding-channel-manager]: Starting (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:01,960] INFO Recorded new KRaft controller, from now on will use node 127.0.0.1:9093 (id: 0 rack: null isFenced: false) (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:01,963] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing DynamicClientQuotaPublisher controller id=0 with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,963] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing DynamicTopicClusterQuotaPublisher controller id=0 with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,964] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing ScramPublisher controller id=0 with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,964] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing DelegationTokenPublisher controller id=0 with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,964] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing ControllerMetadataMetricsPublisher with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,965] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing AclPublisher controller id=0 with a snapshot at offset 9 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:01,966] INFO [client-metrics-reaper]: Starting (org.apache.kafka.server.util.timer.SystemTimerReaper$Reaper) [2026-07-11 03:46:01,976] INFO Updated connection-accept-rate max connection creation rate to 2147483647 (kafka.network.ConnectionQuotas) [2026-07-11 03:46:02,005] INFO JWKS validation key refresh thread started with a refresh interval of 3600000 ms (org.apache.kafka.common.security.oauthbearer.internals.secured.RefreshingHttpsJwks) [2026-07-11 03:46:02,009] INFO Using client secret authentication (third preference/fallback) (org.apache.kafka.common.security.oauthbearer.internals.secured.ClientCredentialsRequestFormatterFactory) [2026-07-11 03:46:02,022] INFO [ControllerRegistrationManager id=0 incarnation=ueoTdGPKRs6hH2ye4codPQ] Our registration has been persisted to the metadata log. (kafka.server.ControllerRegistrationManager) [2026-07-11 03:46:02,024] INFO [ControllerRegistrationManager id=0 incarnation=ueoTdGPKRs6hH2ye4codPQ] RegistrationResponseHandler: controller acknowledged ControllerRegistrationRequest. (kafka.server.ControllerRegistrationManager) [2026-07-11 03:46:02,077] INFO Successfully logged in. (org.apache.kafka.common.security.authenticator.AbstractLogin) [2026-07-11 03:46:02,083] INFO [SocketServer listenerType=BROKER, nodeId=0] Created data-plane acceptor and processors for endpoint : ListenerName(SASL_PLAINTEXT) (kafka.network.SocketServer) [2026-07-11 03:46:02,085] INFO [broker-0-to-controller-alter-partition-channel-manager]: Starting (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:02,085] INFO Recorded new KRaft controller, from now on will use node 127.0.0.1:9093 (id: 0 rack: null isFenced: false) (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:02,087] INFO Using client secret authentication (third preference/fallback) (org.apache.kafka.common.security.oauthbearer.internals.secured.ClientCredentialsRequestFormatterFactory) [2026-07-11 03:46:02,091] INFO Successfully logged in. (org.apache.kafka.common.security.oauthbearer.internals.expiring.ExpiringCredentialRefreshingLogin) [2026-07-11 03:46:02,092] INFO [Principal=:test-client]: Expiring credential re-login thread started. (org.apache.kafka.common.security.oauthbearer.internals.expiring.ExpiringCredentialRefreshingLogin) [2026-07-11 03:46:02,092] INFO [Principal=test-client]: Expiring credential valid from 2026-07-11T03:45:52.000+0000 to 2026-07-11T04:46:02.000+0000 (org.apache.kafka.common.security.oauthbearer.internals.expiring.ExpiringCredentialRefreshingLogin) [2026-07-11 03:46:02,092] INFO [Principal=:test-client]: Expiring credential re-login sleeping until: 2026-07-11T04:36:03.897+0000 (org.apache.kafka.common.security.oauthbearer.internals.expiring.ExpiringCredentialRefreshingLogin) [2026-07-11 03:46:02,095] INFO [broker-0-to-controller-directory-assignments-channel-manager]: Starting (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:02,095] INFO Recorded new KRaft controller, from now on will use node 127.0.0.1:9093 (id: 0 rack: null isFenced: false) (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:02,107] INFO [ExpirationReaper-0-Produce]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:02,108] INFO [ExpirationReaper-0-Fetch]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:02,108] INFO [ExpirationReaper-0-DeleteRecords]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:02,109] INFO [ExpirationReaper-0-RemoteFetch]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:02,110] INFO [ExpirationReaper-0-RemoteListOffsets]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:02,110] INFO [ExpirationReaper-0-ShareFetch]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:02,116] INFO [share-coordinator-reaper]: Starting (org.apache.kafka.server.util.timer.SystemTimerReaper$Reaper) [2026-07-11 03:46:02,127] INFO [share-coordinator-event-processor-0]: Starting (org.apache.kafka.coordinator.common.runtime.MultiThreadedEventProcessor$EventProcessorThread) [2026-07-11 03:46:02,131] INFO [persister-state-manager-reaper]: Starting (org.apache.kafka.server.util.timer.SystemTimerReaper$Reaper) [2026-07-11 03:46:02,132] INFO [PersisterStateManager]: Starting (org.apache.kafka.server.share.persister.PersisterStateManager$SendThread) [2026-07-11 03:46:02,132] INFO [network-partition-metadata-client-reaper]: Starting (org.apache.kafka.server.util.timer.SystemTimerReaper$Reaper) [2026-07-11 03:46:02,133] INFO [group-coordinator-reaper]: Starting (org.apache.kafka.server.util.timer.SystemTimerReaper$Reaper) [2026-07-11 03:46:02,139] INFO [group-coordinator-event-processor-0]: Starting (org.apache.kafka.coordinator.common.runtime.MultiThreadedEventProcessor$EventProcessorThread) [2026-07-11 03:46:02,139] INFO [group-coordinator-event-processor-1]: Starting (org.apache.kafka.coordinator.common.runtime.MultiThreadedEventProcessor$EventProcessorThread) [2026-07-11 03:46:02,139] INFO [group-coordinator-event-processor-2]: Starting (org.apache.kafka.coordinator.common.runtime.MultiThreadedEventProcessor$EventProcessorThread) [2026-07-11 03:46:02,139] INFO [group-coordinator-event-processor-3]: Starting (org.apache.kafka.coordinator.common.runtime.MultiThreadedEventProcessor$EventProcessorThread) [2026-07-11 03:46:02,152] INFO Unable to read the broker epoch in /tmp/kafka-oauth-repro/data_secured. (kafka.log.LogManager) [2026-07-11 03:46:02,153] INFO [broker-0-to-controller-heartbeat-channel-manager]: Starting (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:02,153] INFO Recorded new KRaft controller, from now on will use node 127.0.0.1:9093 (id: 0 rack: null isFenced: false) (org.apache.kafka.server.NodeToControllerRequestThread) [2026-07-11 03:46:02,154] INFO [BrokerLifecycleManager id=0] Incarnation Rh9AryQRQ5i4Jo38zMmLKw of broker 0 in cluster secured-cluster-001 is now STARTING. (org.apache.kafka.server.BrokerLifecycleManager) [2026-07-11 03:46:02,158] INFO [share-group-lock-timeout-reaper]: Starting (org.apache.kafka.server.util.timer.SystemTimerReaper$Reaper) [2026-07-11 03:46:02,165] INFO [ExpirationReaper-0-AlterAcls]: Starting (org.apache.kafka.server.purgatory.DelayedOperationPurgatory$ExpiredOperationReaper) [2026-07-11 03:46:02,176] INFO [BrokerServer id=0] Waiting for the broker metadata publishers to be installed (kafka.server.BrokerServer) [2026-07-11 03:46:02,176] INFO [BrokerServer id=0] Finished waiting for the broker metadata publishers to be installed (kafka.server.BrokerServer) [2026-07-11 03:46:02,176] INFO [BrokerServer id=0] Waiting for the controller to acknowledge that we are caught up (kafka.server.BrokerServer) [2026-07-11 03:46:02,177] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing MetadataVersionPublisher(id=0) with a snapshot at offset 10 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:02,177] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing BrokerMetadataPublisher with a snapshot at offset 10 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:02,178] INFO [BrokerMetadataPublisher id=0] Publishing initial metadata at offset OffsetAndEpoch[offset=10, epoch=1] with metadata.version Optional[4.3-IV0]. (kafka.server.metadata.BrokerMetadataPublisher) [2026-07-11 03:46:02,180] INFO Loading logs from log dirs ArrayBuffer(/tmp/kafka-oauth-repro/data_secured) (kafka.log.LogManager) [2026-07-11 03:46:02,181] INFO No logs found to be loaded in /tmp/kafka-oauth-repro/data_secured (kafka.log.LogManager) [2026-07-11 03:46:02,186] INFO Loaded 0 logs in 6ms (kafka.log.LogManager) [2026-07-11 03:46:02,186] INFO Starting log cleanup with a period of 300000 ms. (kafka.log.LogManager) [2026-07-11 03:46:02,187] INFO Starting log flusher with a default period of 9223372036854775807 ms. (kafka.log.LogManager) [2026-07-11 03:46:02,191] INFO [BrokerLifecycleManager id=0] Successfully registered broker 0 with broker epoch 11 (org.apache.kafka.server.BrokerLifecycleManager) [2026-07-11 03:46:02,208] INFO [LogDirFailureHandler]: Starting (kafka.server.ReplicaManager$LogDirFailureHandler) [2026-07-11 03:46:02,208] INFO [AddPartitionsToTxnSenderThread-0]: Starting (org.apache.kafka.server.transaction.AddPartitionsToTxnManager) [2026-07-11 03:46:02,210] INFO [GroupCoordinator id=0] Starting up. (org.apache.kafka.coordinator.group.GroupCoordinatorService) [2026-07-11 03:46:02,211] INFO [GroupCoordinator id=0] Startup complete. (org.apache.kafka.coordinator.group.GroupCoordinatorService) [2026-07-11 03:46:02,211] INFO [TransactionCoordinator id=0] Starting up. (kafka.coordinator.transaction.TransactionCoordinator) [2026-07-11 03:46:02,212] INFO [TxnMarkerSenderThread-0]: Starting (kafka.coordinator.transaction.TransactionMarkerChannelManager) [2026-07-11 03:46:02,212] INFO [TransactionCoordinator id=0] Startup complete. (kafka.coordinator.transaction.TransactionCoordinator) [2026-07-11 03:46:02,212] INFO [ShareCoordinator id=0] Starting up. (org.apache.kafka.coordinator.share.ShareCoordinatorService) [2026-07-11 03:46:02,212] INFO [ShareCoordinator id=0] Startup complete. (org.apache.kafka.coordinator.share.ShareCoordinatorService) [2026-07-11 03:46:02,215] INFO [DynamicConfigPublisher broker id=0] Updating cluster configuration : min.insync.replicas -> 1 (kafka.server.metadata.DynamicConfigPublisher) [2026-07-11 03:46:02,215] INFO AbstractConfig values: group.consumer.assignment.interval.ms = 1000 group.consumer.assignors = [uniform, range] group.consumer.heartbeat.interval.ms = 5000 group.consumer.max.assignment.interval.ms = 15000 group.consumer.max.heartbeat.interval.ms = 15000 group.consumer.max.session.timeout.ms = 60000 group.consumer.max.size = 2147483647 group.consumer.migration.policy = bidirectional group.consumer.min.assignment.interval.ms = 0 group.consumer.min.heartbeat.interval.ms = 5000 group.consumer.min.session.timeout.ms = 45000 group.consumer.regex.refresh.interval.ms = 600000 group.consumer.session.timeout.ms = 45000 group.coordinator.append.linger.ms = -1 group.coordinator.background.threads = 2 group.coordinator.cached.buffer.max.bytes = 1048588 group.coordinator.rebalance.protocols = [classic, consumer, streams] group.coordinator.threads = 4 group.initial.rebalance.delay.ms = 3000 group.max.session.timeout.ms = 1800000 group.max.size = 2147483647 group.min.session.timeout.ms = 6000 group.share.assignment.interval.ms = 1000 group.share.assignors = [simple] group.share.heartbeat.interval.ms = 5000 group.share.initialize.retry.interval.ms = 30000 group.share.max.assignment.interval.ms = 15000 group.share.max.heartbeat.interval.ms = 15000 group.share.max.session.timeout.ms = 60000 group.share.max.size = 200 group.share.min.assignment.interval.ms = 0 group.share.min.heartbeat.interval.ms = 5000 group.share.min.session.timeout.ms = 45000 group.share.session.timeout.ms = 45000 group.streams.assignment.interval.ms = 1000 group.streams.heartbeat.interval.ms = 5000 group.streams.initial.rebalance.delay.ms = 3000 group.streams.max.assignment.interval.ms = 15000 group.streams.max.heartbeat.interval.ms = 15000 group.streams.max.session.timeout.ms = 60000 group.streams.max.size = 2147483647 group.streams.max.standby.replicas = 2 group.streams.min.assignment.interval.ms = 0 group.streams.min.heartbeat.interval.ms = 5000 group.streams.min.session.timeout.ms = 45000 group.streams.num.standby.replicas = 0 group.streams.session.timeout.ms = 45000 offset.metadata.max.bytes = 4096 offsets.commit.timeout.ms = 5000 offsets.load.buffer.size = 5242880 offsets.retention.check.interval.ms = 600000 offsets.retention.minutes = 10080 offsets.topic.compression.codec = 0 offsets.topic.num.partitions = 50 offsets.topic.replication.factor = 1 offsets.topic.segment.bytes = 104857600 (org.apache.kafka.common.config.AbstractConfig) [2026-07-11 03:46:02,216] INFO KafkaConfig values: add.partitions.to.txn.retry.backoff.max.ms = 100 add.partitions.to.txn.retry.backoff.ms = 20 advertised.listeners = [SASL_PLAINTEXT://127.0.0.1:9092] alter.config.policy.class.name = null alter.log.dirs.replication.quota.window.num = 11 alter.log.dirs.replication.quota.window.size.seconds = 1 authorizer.class.name = auto.create.topics.enable = true auto.leader.rebalance.enable = true background.threads = 10 broker.heartbeat.interval.ms = 2000 broker.id = 0 broker.rack = null broker.session.timeout.ms = 9000 client.quota.callback.class = null compression.gzip.level = -1 compression.lz4.level = 9 compression.type = producer compression.zstd.level = 3 config.providers = [] connection.failed.authentication.delay.ms = 100 connections.max.idle.ms = 600000 connections.max.reauth.ms = 0 controlled.shutdown.enable = true controller.listener.names = [CONTROLLER] controller.performance.always.log.threshold.ms = 2000 controller.performance.sample.period.ms = 60000 controller.quorum.append.linger.ms = 25 controller.quorum.auto.join.enable = false controller.quorum.bootstrap.servers = [] controller.quorum.election.backoff.max.ms = 1000 controller.quorum.election.timeout.ms = 1000 controller.quorum.fetch.max.bytes = 1048576 controller.quorum.fetch.snapshot.max.bytes = 1048576 controller.quorum.fetch.timeout.ms = 2000 controller.quorum.request.timeout.ms = 2000 controller.quorum.retry.backoff.ms = 20 controller.quorum.voters = [0@127.0.0.1:9093] controller.quota.window.num = 11 controller.quota.window.size.seconds = 1 controller.socket.timeout.ms = 30000 cordoned.log.dirs = [] create.topic.policy.class.name = null default.replication.factor = 1 delegation.token.expiry.check.interval.ms = 3600000 delegation.token.expiry.time.ms = 86400000 delegation.token.max.lifetime.ms = 604800000 delegation.token.secret.key = null delete.records.purgatory.purge.interval.requests = 1 delete.topic.enable = true early.start.listeners = null fetch.max.bytes = 57671680 fetch.purgatory.purge.interval.requests = 1000 follower.fetch.last.tiered.offset.enable = false group.consumer.assignment.interval.ms = 1000 group.consumer.assignors = [uniform, range] group.consumer.heartbeat.interval.ms = 5000 group.consumer.max.assignment.interval.ms = 15000 group.consumer.max.heartbeat.interval.ms = 15000 group.consumer.max.session.timeout.ms = 60000 group.consumer.max.size = 2147483647 group.consumer.migration.policy = bidirectional group.consumer.min.assignment.interval.ms = 0 group.consumer.min.heartbeat.interval.ms = 5000 group.consumer.min.session.timeout.ms = 45000 group.consumer.regex.refresh.interval.ms = 600000 group.consumer.session.timeout.ms = 45000 group.coordinator.append.linger.ms = -1 group.coordinator.background.threads = 2 group.coordinator.cached.buffer.max.bytes = 1048588 group.coordinator.rebalance.protocols = [classic, consumer, streams] group.coordinator.threads = 4 group.initial.rebalance.delay.ms = 3000 group.max.session.timeout.ms = 1800000 group.max.size = 2147483647 group.min.session.timeout.ms = 6000 group.share.assignment.interval.ms = 1000 group.share.assignors = [simple] group.share.delivery.count.limit = 5 group.share.heartbeat.interval.ms = 5000 group.share.initialize.retry.interval.ms = 30000 group.share.max.assignment.interval.ms = 15000 group.share.max.delivery.count.limit = 10 group.share.max.heartbeat.interval.ms = 15000 group.share.max.partition.max.record.locks = 4000 group.share.max.record.lock.duration.ms = 60000 group.share.max.session.timeout.ms = 60000 group.share.max.share.sessions = 2000 group.share.max.size = 200 group.share.min.assignment.interval.ms = 0 group.share.min.delivery.count.limit = 2 group.share.min.heartbeat.interval.ms = 5000 group.share.min.partition.max.record.locks = 100 group.share.min.record.lock.duration.ms = 15000 group.share.min.session.timeout.ms = 45000 group.share.partition.max.record.locks = 2000 group.share.persister.class.name = org.apache.kafka.server.share.persister.DefaultStatePersister group.share.record.lock.duration.ms = 30000 group.share.session.timeout.ms = 45000 group.streams.assignment.interval.ms = 1000 group.streams.heartbeat.interval.ms = 5000 group.streams.initial.rebalance.delay.ms = 3000 group.streams.max.assignment.interval.ms = 15000 group.streams.max.heartbeat.interval.ms = 15000 group.streams.max.session.timeout.ms = 60000 group.streams.max.size = 2147483647 group.streams.max.standby.replicas = 2 group.streams.min.assignment.interval.ms = 0 group.streams.min.heartbeat.interval.ms = 5000 group.streams.min.session.timeout.ms = 45000 group.streams.num.standby.replicas = 0 group.streams.session.timeout.ms = 45000 initial.broker.registration.timeout.ms = 60000 inter.broker.listener.name = SASL_PLAINTEXT internal.metadata.delete.delay.millis = 60000 internal.metadata.log.segment.bytes = null internal.metadata.max.batch.size.in.bytes = 8388608 kafka.metrics.polling.interval.secs = 10 kafka.metrics.reporters = [] leader.imbalance.check.interval.seconds = 300 listener.security.protocol.map = SASL_PLAINTEXT:SASL_PLAINTEXT,CONTROLLER:PLAINTEXT listeners = [SASL_PLAINTEXT://127.0.0.1:9092, CONTROLLER://127.0.0.1:9093] log.cleaner.backoff.ms = 15000 log.cleaner.dedupe.buffer.size = 134217728 log.cleaner.delete.retention.ms = 86400000 log.cleaner.enable = true log.cleaner.io.buffer.load.factor = 0.9 log.cleaner.io.buffer.size = 524288 log.cleaner.io.max.bytes.per.second = 1.7976931348623157E308 log.cleaner.max.compaction.lag.ms = 9223372036854775807 log.cleaner.min.cleanable.ratio = 0.5 log.cleaner.min.compaction.lag.ms = 0 log.cleaner.threads = 1 log.cleanup.policy = [delete] log.dir = [/tmp/kafka-logs] log.dir.failure.timeout.ms = 30000 log.dirs = [/tmp/kafka-oauth-repro/data_secured] log.flush.interval.messages = 9223372036854775807 log.flush.interval.ms = null log.flush.offset.checkpoint.interval.ms = 60000 log.flush.scheduler.interval.ms = 9223372036854775807 log.flush.start.offset.checkpoint.interval.ms = 60000 log.index.interval.bytes = 4096 log.index.size.max.bytes = 10485760 log.initial.task.delay.ms = 30000 log.local.retention.bytes = -2 log.local.retention.ms = -2 log.message.timestamp.after.max.ms = 3600000 log.message.timestamp.before.max.ms = 9223372036854775807 log.message.timestamp.type = CreateTime log.preallocate = false log.retention.bytes = -1 log.retention.check.interval.ms = 300000 log.retention.hours = 168 log.retention.minutes = null log.retention.ms = null log.roll.hours = 168 log.roll.jitter.hours = 0 log.roll.jitter.ms = null log.roll.ms = null log.segment.bytes = 1073741824 log.segment.delete.delay.ms = 60000 max.connection.creation.rate = 2147483647 max.connections = 2147483647 max.connections.per.ip = 2147483647 max.connections.per.ip.overrides = max.incremental.fetch.session.cache.slots = 1000 max.request.partition.size.limit = 2000 message.max.bytes = 1048588 metadata.log.dir = null metadata.log.max.record.bytes.between.snapshots = 20971520 metadata.log.max.snapshot.interval.ms = 3600000 metadata.log.segment.bytes = 1073741824 metadata.log.segment.ms = 604800000 metadata.max.idle.interval.ms = 500 metadata.max.retention.bytes = 104857600 metadata.max.retention.ms = 604800000 metric.reporters = [org.apache.kafka.common.metrics.JmxReporter] metrics.num.samples = 2 metrics.recording.level = INFO metrics.sample.window.ms = 30000 min.insync.replicas = 1 node.id = 0 num.io.threads = 8 num.network.threads = 3 num.partitions = 1 num.recovery.threads.per.data.dir = 2 num.replica.alter.log.dirs.threads = null num.replica.fetchers = 1 offset.metadata.max.bytes = 4096 offsets.commit.timeout.ms = 5000 offsets.load.buffer.size = 5242880 offsets.retention.check.interval.ms = 600000 offsets.retention.minutes = 10080 offsets.topic.compression.codec = 0 offsets.topic.num.partitions = 50 offsets.topic.replication.factor = 1 offsets.topic.segment.bytes = 104857600 principal.builder.class = class org.apache.kafka.common.security.authenticator.DefaultKafkaPrincipalBuilder process.roles = [broker, controller] producer.id.expiration.check.interval.ms = 600000 producer.id.expiration.ms = 86400000 producer.purgatory.purge.interval.requests = 1000 queued.max.request.bytes = -1 queued.max.requests = 500 quota.window.num = 11 quota.window.size.seconds = 1 remote.fetch.max.wait.ms = 500 remote.list.offsets.request.timeout.ms = 30000 remote.log.index.file.cache.total.size.bytes = 1073741824 remote.log.index.file.cache.ttl.ms = 900000 remote.log.manager.copier.thread.pool.size = 10 remote.log.manager.copy.max.bytes.per.second = 9223372036854775807 remote.log.manager.copy.quota.window.num = 11 remote.log.manager.copy.quota.window.size.seconds = 1 remote.log.manager.expiration.thread.pool.size = 10 remote.log.manager.fetch.max.bytes.per.second = 9223372036854775807 remote.log.manager.fetch.quota.window.num = 11 remote.log.manager.fetch.quota.window.size.seconds = 1 remote.log.manager.follower.thread.pool.size = 2 remote.log.manager.task.interval.ms = 30000 remote.log.manager.task.retry.backoff.max.ms = 30000 remote.log.manager.task.retry.backoff.ms = 500 remote.log.manager.task.retry.jitter = 0.2 remote.log.manager.thread.pool.size = 2 remote.log.metadata.custom.metadata.max.bytes = 128 remote.log.metadata.manager.class.name = org.apache.kafka.server.log.remote.metadata.storage.TopicBasedRemoteLogMetadataManager remote.log.metadata.manager.class.path = null remote.log.metadata.manager.impl.prefix = rlmm.config. remote.log.metadata.manager.listener.name = null remote.log.reader.max.pending.tasks = 100 remote.log.reader.threads = 10 remote.log.storage.manager.class.name = null remote.log.storage.manager.class.path = null remote.log.storage.manager.impl.prefix = rsm.config. remote.log.storage.system.enable = false replica.fetch.backoff.ms = 1000 replica.fetch.max.bytes = 1048576 replica.fetch.min.bytes = 1 replica.fetch.response.max.bytes = 10485760 replica.fetch.wait.max.ms = 500 replica.high.watermark.checkpoint.interval.ms = 5000 replica.lag.time.max.ms = 30000 replica.selector.class = null replica.socket.receive.buffer.bytes = 65536 replica.socket.timeout.ms = 30000 replication.quota.window.num = 11 replication.quota.window.size.seconds = 1 request.timeout.ms = 30000 sasl.client.callback.handler.class = null sasl.enabled.mechanisms = [OAUTHBEARER] sasl.jaas.config = null sasl.kerberos.kinit.cmd = /usr/bin/kinit sasl.kerberos.min.time.before.relogin = 60000 sasl.kerberos.principal.to.local.rules = [DEFAULT] sasl.kerberos.service.name = null sasl.kerberos.ticket.renew.jitter = 0.05 sasl.kerberos.ticket.renew.window.factor = 0.8 sasl.login.callback.handler.class = null sasl.login.class = null sasl.login.connect.timeout.ms = null sasl.login.read.timeout.ms = null sasl.login.refresh.buffer.seconds = 300 sasl.login.refresh.min.period.seconds = 60 sasl.login.refresh.window.factor = 0.8 sasl.login.refresh.window.jitter = 0.05 sasl.login.retry.backoff.max.ms = 10000 sasl.login.retry.backoff.ms = 100 sasl.mechanism.controller.protocol = GSSAPI sasl.mechanism.inter.broker.protocol = OAUTHBEARER sasl.oauthbearer.assertion.algorithm = RS256 sasl.oauthbearer.assertion.claim.aud = null sasl.oauthbearer.assertion.claim.exp.seconds = 300 sasl.oauthbearer.assertion.claim.iss = null sasl.oauthbearer.assertion.claim.jti.include = false sasl.oauthbearer.assertion.claim.nbf.seconds = 60 sasl.oauthbearer.assertion.claim.sub = null sasl.oauthbearer.assertion.file = null sasl.oauthbearer.assertion.private.key.file = null sasl.oauthbearer.assertion.private.key.passphrase = null sasl.oauthbearer.assertion.template.file = null sasl.oauthbearer.client.credentials.client.id = valid-broker sasl.oauthbearer.client.credentials.client.secret = [hidden] sasl.oauthbearer.clock.skew.seconds = 30 sasl.oauthbearer.expected.audience = [kafka-broker] sasl.oauthbearer.expected.issuer = https://mock-idp.example.com sasl.oauthbearer.jwks.endpoint.refresh.ms = 3600000 sasl.oauthbearer.jwks.endpoint.retry.backoff.max.ms = 10000 sasl.oauthbearer.jwks.endpoint.retry.backoff.ms = 100 sasl.oauthbearer.jwks.endpoint.url = null sasl.oauthbearer.jwt.retriever.class = class org.apache.kafka.common.security.oauthbearer.DefaultJwtRetriever sasl.oauthbearer.jwt.validator.class = class org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator sasl.oauthbearer.scope = null sasl.oauthbearer.scope.claim.name = scope sasl.oauthbearer.sub.claim.name = sub sasl.oauthbearer.token.endpoint.url = http://127.0.0.1:8080/token sasl.server.callback.handler.class = null sasl.server.max.receive.size = 524288 security.inter.broker.protocol = PLAINTEXT security.providers = null server.max.startup.time.ms = 9223372036854775807 share.coordinator.append.linger.ms = -1 share.coordinator.cached.buffer.max.bytes = 1048588 share.coordinator.cold.partition.snapshot.interval.ms = 300000 share.coordinator.load.buffer.size = 5242880 share.coordinator.snapshot.update.records.per.snapshot = 500 share.coordinator.state.topic.compression.codec = 0 share.coordinator.state.topic.min.isr = 2 share.coordinator.state.topic.num.partitions = 50 share.coordinator.state.topic.prune.interval.ms = 300000 share.coordinator.state.topic.replication.factor = 3 share.coordinator.state.topic.segment.bytes = 104857600 share.coordinator.threads = 1 share.coordinator.write.timeout.ms = 5000 share.fetch.purgatory.purge.interval.requests = 1000 socket.connection.setup.timeout.max.ms = 30000 socket.connection.setup.timeout.ms = 10000 socket.listen.backlog.size = 50 socket.receive.buffer.bytes = 102400 socket.request.max.bytes = 104857600 socket.send.buffer.bytes = 102400 ssl.allow.dn.changes = false ssl.allow.san.changes = false ssl.cipher.suites = [] ssl.client.auth = none ssl.enabled.protocols = [TLSv1.2, TLSv1.3] ssl.endpoint.identification.algorithm = https ssl.engine.factory.class = null ssl.key.password = null ssl.keymanager.algorithm = SunX509 ssl.keystore.certificate.chain = null ssl.keystore.key = null ssl.keystore.location = null ssl.keystore.password = null ssl.keystore.type = JKS ssl.principal.mapping.rules = DEFAULT ssl.protocol = TLSv1.3 ssl.provider = null ssl.secure.random.implementation = null ssl.trustmanager.algorithm = PKIX ssl.truststore.certificates = null ssl.truststore.location = null ssl.truststore.password = null ssl.truststore.type = JKS telemetry.max.bytes = 1048576 transaction.abort.timed.out.transaction.cleanup.interval.ms = 10000 transaction.max.timeout.ms = 900000 transaction.partition.verification.enable = true transaction.remove.expired.transaction.cleanup.interval.ms = 3600000 transaction.state.log.load.buffer.size = 5242880 transaction.state.log.min.isr = 1 transaction.state.log.num.partitions = 50 transaction.state.log.replication.factor = 1 transaction.state.log.segment.bytes = 104857600 transaction.two.phase.commit.enable = false transactional.id.expiration.ms = 604800000 unclean.leader.election.enable = false unclean.leader.election.interval.ms = 300000 unstable.api.versions.enable = false unstable.feature.versions.enable = false (org.apache.kafka.common.config.AbstractConfig) [2026-07-11 03:46:02,223] INFO [BrokerMetadataPublisher id=0] Feature share.version has been updated to version 1 (kafka.server.metadata.BrokerMetadataPublisher) [2026-07-11 03:46:02,223] INFO [MetadataLoader id=0] InitializeNewPublishers: initializing BrokerRegistrationTracker(id=0) with a snapshot at offset 10 (org.apache.kafka.image.loader.MetadataLoader) [2026-07-11 03:46:02,234] INFO [BrokerLifecycleManager id=0] The broker has caught up. Transitioning from STARTING to RECOVERY. (org.apache.kafka.server.BrokerLifecycleManager) [2026-07-11 03:46:02,235] INFO [BrokerServer id=0] Finished waiting for the controller to acknowledge that we are caught up (kafka.server.BrokerServer) [2026-07-11 03:46:02,235] INFO [BrokerServer id=0] Waiting for the initial broker metadata update to be published (kafka.server.BrokerServer) [2026-07-11 03:46:02,235] INFO [BrokerServer id=0] Finished waiting for the initial broker metadata update to be published (kafka.server.BrokerServer) [2026-07-11 03:46:02,236] INFO KafkaConfig values: add.partitions.to.txn.retry.backoff.max.ms = 100 add.partitions.to.txn.retry.backoff.ms = 20 advertised.listeners = [SASL_PLAINTEXT://127.0.0.1:9092] alter.config.policy.class.name = null alter.log.dirs.replication.quota.window.num = 11 alter.log.dirs.replication.quota.window.size.seconds = 1 authorizer.class.name = auto.create.topics.enable = true auto.leader.rebalance.enable = true background.threads = 10 broker.heartbeat.interval.ms = 2000 broker.id = 0 broker.rack = null broker.session.timeout.ms = 9000 client.quota.callback.class = null compression.gzip.level = -1 compression.lz4.level = 9 compression.type = producer compression.zstd.level = 3 config.providers = [] connection.failed.authentication.delay.ms = 100 connections.max.idle.ms = 600000 connections.max.reauth.ms = 0 controlled.shutdown.enable = true controller.listener.names = [CONTROLLER] controller.performance.always.log.threshold.ms = 2000 controller.performance.sample.period.ms = 60000 controller.quorum.append.linger.ms = 25 controller.quorum.auto.join.enable = false controller.quorum.bootstrap.servers = [] controller.quorum.election.backoff.max.ms = 1000 controller.quorum.election.timeout.ms = 1000 controller.quorum.fetch.max.bytes = 1048576 controller.quorum.fetch.snapshot.max.bytes = 1048576 controller.quorum.fetch.timeout.ms = 2000 controller.quorum.request.timeout.ms = 2000 controller.quorum.retry.backoff.ms = 20 controller.quorum.voters = [0@127.0.0.1:9093] controller.quota.window.num = 11 controller.quota.window.size.seconds = 1 controller.socket.timeout.ms = 30000 cordoned.log.dirs = [] create.topic.policy.class.name = null default.replication.factor = 1 delegation.token.expiry.check.interval.ms = 3600000 delegation.token.expiry.time.ms = 86400000 delegation.token.max.lifetime.ms = 604800000 delegation.token.secret.key = null delete.records.purgatory.purge.interval.requests = 1 delete.topic.enable = true early.start.listeners = null fetch.max.bytes = 57671680 fetch.purgatory.purge.interval.requests = 1000 follower.fetch.last.tiered.offset.enable = false group.consumer.assignment.interval.ms = 1000 group.consumer.assignors = [uniform, range] group.consumer.heartbeat.interval.ms = 5000 group.consumer.max.assignment.interval.ms = 15000 group.consumer.max.heartbeat.interval.ms = 15000 group.consumer.max.session.timeout.ms = 60000 group.consumer.max.size = 2147483647 group.consumer.migration.policy = bidirectional group.consumer.min.assignment.interval.ms = 0 group.consumer.min.heartbeat.interval.ms = 5000 group.consumer.min.session.timeout.ms = 45000 group.consumer.regex.refresh.interval.ms = 600000 group.consumer.session.timeout.ms = 45000 group.coordinator.append.linger.ms = -1 group.coordinator.background.threads = 2 group.coordinator.cached.buffer.max.bytes = 1048588 group.coordinator.rebalance.protocols = [classic, consumer, streams] group.coordinator.threads = 4 group.initial.rebalance.delay.ms = 3000 group.max.session.timeout.ms = 1800000 group.max.size = 2147483647 group.min.session.timeout.ms = 6000 group.share.assignment.interval.ms = 1000 group.share.assignors = [simple] group.share.delivery.count.limit = 5 group.share.heartbeat.interval.ms = 5000 group.share.initialize.retry.interval.ms = 30000 group.share.max.assignment.interval.ms = 15000 group.share.max.delivery.count.limit = 10 group.share.max.heartbeat.interval.ms = 15000 group.share.max.partition.max.record.locks = 4000 group.share.max.record.lock.duration.ms = 60000 group.share.max.session.timeout.ms = 60000 group.share.max.share.sessions = 2000 group.share.max.size = 200 group.share.min.assignment.interval.ms = 0 group.share.min.delivery.count.limit = 2 group.share.min.heartbeat.interval.ms = 5000 group.share.min.partition.max.record.locks = 100 group.share.min.record.lock.duration.ms = 15000 group.share.min.session.timeout.ms = 45000 group.share.partition.max.record.locks = 2000 group.share.persister.class.name = org.apache.kafka.server.share.persister.DefaultStatePersister group.share.record.lock.duration.ms = 30000 group.share.session.timeout.ms = 45000 group.streams.assignment.interval.ms = 1000 group.streams.heartbeat.interval.ms = 5000 group.streams.initial.rebalance.delay.ms = 3000 group.streams.max.assignment.interval.ms = 15000 group.streams.max.heartbeat.interval.ms = 15000 group.streams.max.session.timeout.ms = 60000 group.streams.max.size = 2147483647 group.streams.max.standby.replicas = 2 group.streams.min.assignment.interval.ms = 0 group.streams.min.heartbeat.interval.ms = 5000 group.streams.min.session.timeout.ms = 45000 group.streams.num.standby.replicas = 0 group.streams.session.timeout.ms = 45000 initial.broker.registration.timeout.ms = 60000 inter.broker.listener.name = SASL_PLAINTEXT internal.metadata.delete.delay.millis = 60000 internal.metadata.log.segment.bytes = null internal.metadata.max.batch.size.in.bytes = 8388608 kafka.metrics.polling.interval.secs = 10 kafka.metrics.reporters = [] leader.imbalance.check.interval.seconds = 300 listener.security.protocol.map = SASL_PLAINTEXT:SASL_PLAINTEXT,CONTROLLER:PLAINTEXT listeners = [SASL_PLAINTEXT://127.0.0.1:9092, CONTROLLER://127.0.0.1:9093] log.cleaner.backoff.ms = 15000 log.cleaner.dedupe.buffer.size = 134217728 log.cleaner.delete.retention.ms = 86400000 log.cleaner.enable = true log.cleaner.io.buffer.load.factor = 0.9 log.cleaner.io.buffer.size = 524288 log.cleaner.io.max.bytes.per.second = 1.7976931348623157E308 log.cleaner.max.compaction.lag.ms = 9223372036854775807 log.cleaner.min.cleanable.ratio = 0.5 log.cleaner.min.compaction.lag.ms = 0 log.cleaner.threads = 1 log.cleanup.policy = [delete] log.dir = [/tmp/kafka-logs] log.dir.failure.timeout.ms = 30000 log.dirs = [/tmp/kafka-oauth-repro/data_secured] log.flush.interval.messages = 9223372036854775807 log.flush.interval.ms = null log.flush.offset.checkpoint.interval.ms = 60000 log.flush.scheduler.interval.ms = 9223372036854775807 log.flush.start.offset.checkpoint.interval.ms = 60000 log.index.interval.bytes = 4096 log.index.size.max.bytes = 10485760 log.initial.task.delay.ms = 30000 log.local.retention.bytes = -2 log.local.retention.ms = -2 log.message.timestamp.after.max.ms = 3600000 log.message.timestamp.before.max.ms = 9223372036854775807 log.message.timestamp.type = CreateTime log.preallocate = false log.retention.bytes = -1 log.retention.check.interval.ms = 300000 log.retention.hours = 168 log.retention.minutes = null log.retention.ms = null log.roll.hours = 168 log.roll.jitter.hours = 0 log.roll.jitter.ms = null log.roll.ms = null log.segment.bytes = 1073741824 log.segment.delete.delay.ms = 60000 max.connection.creation.rate = 2147483647 max.connections = 2147483647 max.connections.per.ip = 2147483647 max.connections.per.ip.overrides = max.incremental.fetch.session.cache.slots = 1000 max.request.partition.size.limit = 2000 message.max.bytes = 1048588 metadata.log.dir = null metadata.log.max.record.bytes.between.snapshots = 20971520 metadata.log.max.snapshot.interval.ms = 3600000 metadata.log.segment.bytes = 1073741824 metadata.log.segment.ms = 604800000 metadata.max.idle.interval.ms = 500 metadata.max.retention.bytes = 104857600 metadata.max.retention.ms = 604800000 metric.reporters = [org.apache.kafka.common.metrics.JmxReporter] metrics.num.samples = 2 metrics.recording.level = INFO metrics.sample.window.ms = 30000 min.insync.replicas = 1 node.id = 0 num.io.threads = 8 num.network.threads = 3 num.partitions = 1 num.recovery.threads.per.data.dir = 2 num.replica.alter.log.dirs.threads = null num.replica.fetchers = 1 offset.metadata.max.bytes = 4096 offsets.commit.timeout.ms = 5000 offsets.load.buffer.size = 5242880 offsets.retention.check.interval.ms = 600000 offsets.retention.minutes = 10080 offsets.topic.compression.codec = 0 offsets.topic.num.partitions = 50 offsets.topic.replication.factor = 1 offsets.topic.segment.bytes = 104857600 principal.builder.class = class org.apache.kafka.common.security.authenticator.DefaultKafkaPrincipalBuilder process.roles = [broker, controller] producer.id.expiration.check.interval.ms = 600000 producer.id.expiration.ms = 86400000 producer.purgatory.purge.interval.requests = 1000 queued.max.request.bytes = -1 queued.max.requests = 500 quota.window.num = 11 quota.window.size.seconds = 1 remote.fetch.max.wait.ms = 500 remote.list.offsets.request.timeout.ms = 30000 remote.log.index.file.cache.total.size.bytes = 1073741824 remote.log.index.file.cache.ttl.ms = 900000 remote.log.manager.copier.thread.pool.size = 10 remote.log.manager.copy.max.bytes.per.second = 9223372036854775807 remote.log.manager.copy.quota.window.num = 11 remote.log.manager.copy.quota.window.size.seconds = 1 remote.log.manager.expiration.thread.pool.size = 10 remote.log.manager.fetch.max.bytes.per.second = 9223372036854775807 remote.log.manager.fetch.quota.window.num = 11 remote.log.manager.fetch.quota.window.size.seconds = 1 remote.log.manager.follower.thread.pool.size = 2 remote.log.manager.task.interval.ms = 30000 remote.log.manager.task.retry.backoff.max.ms = 30000 remote.log.manager.task.retry.backoff.ms = 500 remote.log.manager.task.retry.jitter = 0.2 remote.log.manager.thread.pool.size = 2 remote.log.metadata.custom.metadata.max.bytes = 128 remote.log.metadata.manager.class.name = org.apache.kafka.server.log.remote.metadata.storage.TopicBasedRemoteLogMetadataManager remote.log.metadata.manager.class.path = null remote.log.metadata.manager.impl.prefix = rlmm.config. remote.log.metadata.manager.listener.name = null remote.log.reader.max.pending.tasks = 100 remote.log.reader.threads = 10 remote.log.storage.manager.class.name = null remote.log.storage.manager.class.path = null remote.log.storage.manager.impl.prefix = rsm.config. remote.log.storage.system.enable = false replica.fetch.backoff.ms = 1000 replica.fetch.max.bytes = 1048576 replica.fetch.min.bytes = 1 replica.fetch.response.max.bytes = 10485760 replica.fetch.wait.max.ms = 500 replica.high.watermark.checkpoint.interval.ms = 5000 replica.lag.time.max.ms = 30000 replica.selector.class = null replica.socket.receive.buffer.bytes = 65536 replica.socket.timeout.ms = 30000 replication.quota.window.num = 11 replication.quota.window.size.seconds = 1 request.timeout.ms = 30000 sasl.client.callback.handler.class = null sasl.enabled.mechanisms = [OAUTHBEARER] sasl.jaas.config = null sasl.kerberos.kinit.cmd = /usr/bin/kinit sasl.kerberos.min.time.before.relogin = 60000 sasl.kerberos.principal.to.local.rules = [DEFAULT] sasl.kerberos.service.name = null sasl.kerberos.ticket.renew.jitter = 0.05 sasl.kerberos.ticket.renew.window.factor = 0.8 sasl.login.callback.handler.class = null sasl.login.class = null sasl.login.connect.timeout.ms = null sasl.login.read.timeout.ms = null sasl.login.refresh.buffer.seconds = 300 sasl.login.refresh.min.period.seconds = 60 sasl.login.refresh.window.factor = 0.8 sasl.login.refresh.window.jitter = 0.05 sasl.login.retry.backoff.max.ms = 10000 sasl.login.retry.backoff.ms = 100 sasl.mechanism.controller.protocol = GSSAPI sasl.mechanism.inter.broker.protocol = OAUTHBEARER sasl.oauthbearer.assertion.algorithm = RS256 sasl.oauthbearer.assertion.claim.aud = null sasl.oauthbearer.assertion.claim.exp.seconds = 300 sasl.oauthbearer.assertion.claim.iss = null sasl.oauthbearer.assertion.claim.jti.include = false sasl.oauthbearer.assertion.claim.nbf.seconds = 60 sasl.oauthbearer.assertion.claim.sub = null sasl.oauthbearer.assertion.file = null sasl.oauthbearer.assertion.private.key.file = null sasl.oauthbearer.assertion.private.key.passphrase = null sasl.oauthbearer.assertion.template.file = null sasl.oauthbearer.client.credentials.client.id = valid-broker sasl.oauthbearer.client.credentials.client.secret = [hidden] sasl.oauthbearer.clock.skew.seconds = 30 sasl.oauthbearer.expected.audience = [kafka-broker] sasl.oauthbearer.expected.issuer = https://mock-idp.example.com sasl.oauthbearer.jwks.endpoint.refresh.ms = 3600000 sasl.oauthbearer.jwks.endpoint.retry.backoff.max.ms = 10000 sasl.oauthbearer.jwks.endpoint.retry.backoff.ms = 100 sasl.oauthbearer.jwks.endpoint.url = null sasl.oauthbearer.jwt.retriever.class = class org.apache.kafka.common.security.oauthbearer.DefaultJwtRetriever sasl.oauthbearer.jwt.validator.class = class org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator sasl.oauthbearer.scope = null sasl.oauthbearer.scope.claim.name = scope sasl.oauthbearer.sub.claim.name = sub sasl.oauthbearer.token.endpoint.url = http://127.0.0.1:8080/token sasl.server.callback.handler.class = null sasl.server.max.receive.size = 524288 security.inter.broker.protocol = PLAINTEXT security.providers = null server.max.startup.time.ms = 9223372036854775807 share.coordinator.append.linger.ms = -1 share.coordinator.cached.buffer.max.bytes = 1048588 share.coordinator.cold.partition.snapshot.interval.ms = 300000 share.coordinator.load.buffer.size = 5242880 share.coordinator.snapshot.update.records.per.snapshot = 500 share.coordinator.state.topic.compression.codec = 0 share.coordinator.state.topic.min.isr = 2 share.coordinator.state.topic.num.partitions = 50 share.coordinator.state.topic.prune.interval.ms = 300000 share.coordinator.state.topic.replication.factor = 3 share.coordinator.state.topic.segment.bytes = 104857600 share.coordinator.threads = 1 share.coordinator.write.timeout.ms = 5000 share.fetch.purgatory.purge.interval.requests = 1000 socket.connection.setup.timeout.max.ms = 30000 socket.connection.setup.timeout.ms = 10000 socket.listen.backlog.size = 50 socket.receive.buffer.bytes = 102400 socket.request.max.bytes = 104857600 socket.send.buffer.bytes = 102400 ssl.allow.dn.changes = false ssl.allow.san.changes = false ssl.cipher.suites = [] ssl.client.auth = none ssl.enabled.protocols = [TLSv1.2, TLSv1.3] ssl.endpoint.identification.algorithm = https ssl.engine.factory.class = null ssl.key.password = null ssl.keymanager.algorithm = SunX509 ssl.keystore.certificate.chain = null ssl.keystore.key = null ssl.keystore.location = null ssl.keystore.password = null ssl.keystore.type = JKS ssl.principal.mapping.rules = DEFAULT ssl.protocol = TLSv1.3 ssl.provider = null ssl.secure.random.implementation = null ssl.trustmanager.algorithm = PKIX ssl.truststore.certificates = null ssl.truststore.location = null ssl.truststore.password = null ssl.truststore.type = JKS telemetry.max.bytes = 1048576 transaction.abort.timed.out.transaction.cleanup.interval.ms = 10000 transaction.max.timeout.ms = 900000 transaction.partition.verification.enable = true transaction.remove.expired.transaction.cleanup.interval.ms = 3600000 transaction.state.log.load.buffer.size = 5242880 transaction.state.log.min.isr = 1 transaction.state.log.num.partitions = 50 transaction.state.log.replication.factor = 1 transaction.state.log.segment.bytes = 104857600 transaction.two.phase.commit.enable = false transactional.id.expiration.ms = 604800000 unclean.leader.election.enable = false unclean.leader.election.interval.ms = 300000 unstable.api.versions.enable = false unstable.feature.versions.enable = false (org.apache.kafka.common.config.AbstractConfig) [2026-07-11 03:46:02,238] INFO [BrokerServer id=0] Waiting for the broker to be unfenced (kafka.server.BrokerServer) [2026-07-11 03:46:02,268] INFO [BrokerLifecycleManager id=0] The broker has been unfenced. Transitioning from RECOVERY to RUNNING. (org.apache.kafka.server.BrokerLifecycleManager) [2026-07-11 03:46:02,268] INFO [BrokerServer id=0] Finished waiting for the broker to be unfenced (kafka.server.BrokerServer) [2026-07-11 03:46:02,269] INFO authorizerStart completed for endpoint SASL_PLAINTEXT. Endpoint is now READY. (org.apache.kafka.server.network.EndpointReadyFutures) [2026-07-11 03:46:02,269] INFO [SocketServer listenerType=BROKER, nodeId=0] Enabling request processing. (kafka.network.SocketServer) [2026-07-11 03:46:02,269] INFO Awaiting socket connections on 127.0.0.1:9092. (kafka.network.DataPlaneAcceptor) [2026-07-11 03:46:02,270] INFO [BrokerServer id=0] Waiting for all of the authorizer futures to be completed (kafka.server.BrokerServer) [2026-07-11 03:46:02,270] INFO [BrokerServer id=0] Finished waiting for all of the authorizer futures to be completed (kafka.server.BrokerServer) [2026-07-11 03:46:02,270] INFO [BrokerServer id=0] Waiting for all of the SocketServer Acceptors to be started (kafka.server.BrokerServer) [2026-07-11 03:46:02,270] INFO [BrokerServer id=0] Finished waiting for all of the SocketServer Acceptors to be started (kafka.server.BrokerServer) [2026-07-11 03:46:02,270] INFO [BrokerServer id=0] Transition from STARTING to STARTED (kafka.server.BrokerServer) [2026-07-11 03:46:02,271] INFO Kafka version: 4.3.1 (org.apache.kafka.common.utils.AppInfoParser) [2026-07-11 03:46:02,271] INFO Kafka commitId: 26b251a451ce941d (org.apache.kafka.common.utils.AppInfoParser) [2026-07-11 03:46:02,271] INFO Kafka startTimeMs: 1783741562270 (org.apache.kafka.common.utils.AppInfoParser) [2026-07-11 03:46:02,272] INFO [KafkaRaftServer nodeId=0] Kafka Server started (kafka.server.KafkaRaftServer) [2026-07-11 03:46:03,604] WARN Could not validate the access token: JWT (claims->{"sub":"test-client","iss":"https://mock-idp.example.com","aud":"kafka-broker","iat":1783741553,"exp":1783737963,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[1] The JWT is no longer valid - the evaluation time NumericDate{1783741563 -> Jul 11, 2026, 3:46:03 AM UTC} is on or after the Expiration Time (exp=NumericDate{1783737963 -> Jul 11, 2026, 2:46:03 AM UTC}) claim value (even when providing 30 seconds of leeway to account for clock skew).] (org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler) org.apache.kafka.common.security.oauthbearer.JwtValidatorException: Could not validate the access token: JWT (claims->{"sub":"test-client","iss":"https://mock-idp.example.com","aud":"kafka-broker","iat":1783741553,"exp":1783737963,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[1] The JWT is no longer valid - the evaluation time NumericDate{1783741563 -> Jul 11, 2026, 3:46:03 AM UTC} is on or after the Expiration Time (exp=NumericDate{1783737963 -> Jul 11, 2026, 2:46:03 AM UTC}) claim value (even when providing 30 seconds of leeway to account for clock skew).] at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:170) at org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator.validate(DefaultJwtValidator.java:76) at org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler.handleValidatorCallback(OAuthBearerValidatorCallbackHandler.java:173) at org.apache.kafka.common.security.oauthbearer.OAuthBearerValidatorCallbackHandler.handle(OAuthBearerValidatorCallbackHandler.java:158) at org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerSaslServer.process(OAuthBearerSaslServer.java:156) at org.apache.kafka.common.security.oauthbearer.internals.OAuthBearerSaslServer.evaluateResponse(OAuthBearerSaslServer.java:101) at org.apache.kafka.common.security.authenticator.SaslServerAuthenticator.handleSaslToken(SaslServerAuthenticator.java:461) at org.apache.kafka.common.security.authenticator.SaslServerAuthenticator.authenticate(SaslServerAuthenticator.java:286) at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:181) at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:548) at org.apache.kafka.common.network.Selector.poll(Selector.java:486) at kafka.network.Processor.poll(SocketServer.scala:993) at kafka.network.Processor.run(SocketServer.scala:897) at java.base/java.lang.Thread.run(Thread.java:840) Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT (claims->{"sub":"test-client","iss":"https://mock-idp.example.com","aud":"kafka-broker","iat":1783741553,"exp":1783737963,"scope":"kafka-cluster"}) rejected due to invalid claims or other invalid content. Additional details: [[1] The JWT is no longer valid - the evaluation time NumericDate{1783741563 -> Jul 11, 2026, 3:46:03 AM UTC} is on or after the Expiration Time (exp=NumericDate{1783737963 -> Jul 11, 2026, 2:46:03 AM UTC}) claim value (even when providing 30 seconds of leeway to account for clock skew).] at org.jose4j.jwt.consumer.JwtConsumer.validate(JwtConsumer.java:459) at org.jose4j.jwt.consumer.JwtConsumer.processContext(JwtConsumer.java:304) at org.jose4j.jwt.consumer.JwtConsumer.process(JwtConsumer.java:410) at org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator.validate(BrokerJwtValidator.java:168) ... 13 more [2026-07-11 03:46:03,606] INFO [SocketServer listenerType=BROKER, nodeId=0] Failed authentication with /127.0.0.1 (channelId=127.0.0.1:9092-127.0.0.1:34338-1-0) ({"status":"invalid_token"}) (org.apache.kafka.common.network.Selector)