Snowflake sink connector - state FAILED java.lang.NoClassDefFoundError org/bouncycastle/jcajce/provider/BouncyCastleFipsProvider

Question

Snowflake connector failed to create a connector task on a distributed Kafka Connect cluster.

Snowflake connector version: 1.2.4

full error trace:

"java.lang.NoClassDefFoundError: org/bouncycastle/jcajce/provider/BouncyCastleFipsProvider\n\tat com.snowflake.kafka.connector.internal.InternalUtils.createProperties(InternalUtils.java:162)\n\tat com.snowflake.kafka.connector.internal.SnowflakeConnectionServiceFactory$SnowflakeConnectionServiceBuilder.setProperties(SnowflakeConnectionServiceFactory.java:40)\n\tat com.snowflake.kafka.connector.SnowflakeSinkConnector.start(SnowflakeSinkConnector.java:105)\n\tat org.apache.kafka.connect.runtime.WorkerConnector.doStart(WorkerConnector.java:111)\n\tat org.apache.kafka.connect.runtime.WorkerConnector.start(WorkerConnector.java:136)\n\tat org.apache.kafka.connect.runtime.WorkerConnector.transitionTo(WorkerConnector.java:196)\n\tat org.apache.kafka.connect.runtime.Worker.startConnector(Worker.java:252)\n\tat org.apache.kafka.connect.runtime.distributed.DistributedHerder.startConnector(DistributedHerder.java:1079)\n\tat org.apache.kafka.connect.runtime.distributed.DistributedHerder.access$1300(DistributedHerder.java:117)\n\tat org.apache.kafka.connect.runtime.distributed.DistributedHerder$15.call(DistributedHerder.java:1095)\n\tat org.apache.kafka.connect.runtime.distributed.DistributedHerder$15.call(DistributedHerder.java:1091)\n\tat java.util.concurrent.FutureTask.run(FutureTask.java:266)\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\n\tat java.lang.Thread.run(Thread.java:745)\nCaused by: java.lang.ClassNotFoundException: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider\n\tat java.net.URLClassLoader.findClass(URLClassLoader.java:381)\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:424)\n\tat org.apache.kafka.connect.runtime.isolation.PluginClassLoader.loadClass(PluginClassLoader.java:104)\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:357)\n\t... 15 more\n"

Answer 1

The Snowflake Kafka Connector uses key-pair based authentication which requires libraries supporting FIPS-compliant cryptographic algorithms in addition to the Snowflake JDBC driver.

The libraries that provide those are not redistributable within the connector for various reasons.

Quoting a relevant portion from the first FIPS-compliant Snowflake JDBC Connector release notes:

Snowflake JDBC Driver: FIPS-Compliant Driver Released

[…]

The driver has dependencies on two .jar files that are not supplied by Snowflake. The.jar files are provided by org.bouncycastle and are available from Maven and other download sites:

bc-fips, version 1.0.1

bcpkix-fips, version 1.0.3

Bouncy Castle's bc-fips jar, version 1.0.1 can be downloaded here and the bcpkix-fips jar, version 1.0.3 can be downloaded here.

Download these two files and distribute them onto your Kafka Connect plugin directory and retry the execution.