Upgrading Apache Kafka 2.7 to Java 11 Changes authenticationID sent to ZooKeeper Enabling Only 1 Kafka Broker to r/w znodes

I am having some trouble upgrading a kerberized Kafka 2.7 cluster to Java 11. Once upgraded, Kafka no longer sends the expected authenticationID to ZooKeeper and the ACLs on the znodes now only allow access to the Kafka host that first created them. Complete details of this problem can be found

RE: Unable to Restrict Access to Consumer Group ACLs

? Yes, you guessed it . . . it works as you would expect and limits access to the specifically defined group. -Original Message- From: Chapin, Ryan Sent: Monday, January 07, 2019 2:12 PM To: users@kafka.apache.org Subject: Unable to Restrict Access to Consumer Group ACLs WARNING

Unable to Restrict Access to Consumer Group ACLs

I do not seem to be able to restrict access to specific users for specific consumer groups. It seems as though I am doing something wrong, or that there is a bug as I imagine what I am trying to do is very straight forward. We have an 11 node cluster running the 2.11-1.0.0 open source version