# Logstash Unable to renew Kerberos ticket

**URL:** https://discuss.elastic.co/t/logstash-unable-to-renew-kerberos-ticket/252241
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [October 15, 2020, 4:58pm UTC](https://discuss.elastic.co/t/logstash-unable-to-renew-kerberos-ticket/252241 "2020-10-15T16:58:16Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![burkeg](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@burkeg](https://discuss.elastic.co/u/burkeg)
#### Post date: [October 15, 2020, 4:58pm UTC](https://discuss.elastic.co/t/logstash-unable-to-renew-kerberos-ticket/252241/1 "2020-10-15T16:58:16Z")

</div>

Hi,  
I'm trying to setup logstash agent with Kafka output that has Kerberos based authentication and uses SASL\_SSL mechanism. Logstash agent works fine when started but fails to renew Kerberos ticket.

I've configured the jaas with following properties

```auto
    KafkaClient {
         com.sun.security.auth.module.Krb5LoginModule required
         useKeyTab=true
         keyTab="service.keytab"
         storeKey=true
         useTicketCache=true
         serviceName="kafka"
         principal="<principal>";
        };

```

logstash config:

```auto
     input {
      file {
        path => ["test"]
      }
    }
    output {
      kafka {
            topic_id => "<topic>"
            bootstrap_servers => "<broker>"
            compression_type => "snappy"
            jaas_path => "jaas.conf"
            kerberos_config => "/etc/krb5.conf"
            sasl_kerberos_service_name => "kafka"
            security_protocol => "SASL_SSL"
            client_id => "client"
            ssl_truststore_location => "truststore.jks"
            ssl_truststore_password => "<password>"
        }
    }

```

Java version:

```auto
     openjdk version "11.0.8" 2020-07-14
    OpenJDK Runtime Environment (build 11.0.8+10-post-Ubuntu-0ubuntu118.04.1)
    OpenJDK 64-Bit Server VM (build 11.0.8+10-post-Ubuntu-0ubuntu118.04.1, mixed mode, sharing)

```

logstash version: `7.9.2`

How can I make sure that logstash is renewing the ticket before it is expired?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 12, 2020, 4:58pm UTC](https://discuss.elastic.co/t/logstash-unable-to-renew-kerberos-ticket/252241/2 "2020-11-12T16:58:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.