Hi, @Ankit88 , thanks for the info!   The error that you're getting is because the host in the cloud where your application is running doesn't know anything about your Kerberos configuration, in particular, where your KDC is.   There's a few things you must do to configure it properly: Ensure the Kerberos client libraries are installed on that host (krb5-workstation package) Your on-prem krb5.conf file must be copied to the cloud host. If you also have a Kerberos KDC in the cloud, there will already be a krb5.conf file on that host and the two configurations will need to be carefully merged. The sections [realms] and [domain_realm] are especially important to solve your issue. Ensure that the hostname of your KDC as well as the host names of ALL Kafka brokers can be resolved from the cloud (you can test it with nslookup and/or ping). This must work correctly for Kerberos to work. If there's no integrated DNS you will have to add entries to your /etc/hosts file to ensure the resolution is correct. Ensure that any firewalls are configured correctly to open ports between your application and your on-prem environment: Open all the ports required for the client to connect to Kafka Open all the ports required for the client to communicate with the KDC (typically, ports 88 UDP and 88 TCP) The above being correctly configuration, you should be able to authenticate correctly using Kerberos. A simple test to ensure it's working, before you try the Kafka application, is to authenticate on the command line using the kinit command.   Hope this helps. André -- Was your question answered? Please take some time to click on "Accept as Solution" below this post. If you find a reply useful, say thanks by clicking on the thumbs up button. ... View more

Hi , @krishna123,   Thanks for the output! This explains the issue that you're seeing. You mentioned before that you were using Java 1.8.0_275, but the log line you just provided shows that NiFi is actually using Java 1.8.0_74.   In this version of Java, cryptographic key sizes are limited and NiFi cannot not handle AES keys larger than 128 bits. Because of that, NiFi fails to instantiate AES iphers properly. To enable that in your Java version, you would have to download the Java Cryptography Extension (JCE) Unlimited Strength policies and copy them to your Java home manually to allow AES keys of size 256 and larger. These policies are only included by default in the JDK starting from update 1.8.0_162.   If you already have Java 1.8.0_275 installed, make sure NiFi can see it and use it. This will solve your problem. You can verify which Java version NiFi is using by checking the line that I mentioned in the log.   Cheers, André -- Was your question answered? Please take some time to click on "Accept as Solution" below this post. If you find a reply useful, say thanks by clicking on the thumbs up button. ... View more