java - Spring-Kafka : Issue while deserialising kafka message - class not in a "trusted package"?

Question

I get the below exception because I produce from one project and the consumer consumes from another project. How can I fix this. Obviously the packages are not the same. So how can I ensure that there is proper json serialization.

The class 'com.lte.assessment.assessments.AssessmentAttemptRequest' is not in the trusted packages: [java.util, java.lang, com.lte.assessmentanalytics.model

Consumer Config

@EnableKafka
@Configuration
public class KafkaConfig {
    static Map<String, Object> config = new HashMap();

    static {
        config.put(ConsumerConfig.BOOTSTRAP_SERVERS_CONFIG, "127.0.0.1:9092");
        config.put(ConsumerConfig.GROUP_ID_CONFIG, "group_id");
        config.put(ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG, StringDeserializer.class);
        config.put(ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG, JsonDeserializer.class);
    }


      @Bean
public ConsumerFactory<String, AssessmentAttemptRequest> assessmentAttemptDetailsEntityConsumerFactory() {
    JsonDeserializer<AssessmentAttemptRequest> deserializer = new JsonDeserializer<>();
    deserializer.addTrustedPackages("com.lte.assessment.assessments");
    return new DefaultKafkaConsumerFactory(config, new StringDeserializer(), deserializer);
}

}

Producer Config

@Configuration
public class KafkaConfiguration {

    @Bean
    public ProducerFactory producerConfig() {
        Map<String, Object> config = new HashMap();

        config.put(ProducerConfig.BOOTSTRAP_SERVERS_CONFIG, "127.0.0.1:9092");
        config.put(ProducerConfig.KEY_SERIALIZER_CLASS_CONFIG, StringSerializer.class);
        config.put(ProducerConfig.VALUE_SERIALIZER_CLASS_CONFIG, JsonSerializer.class);

        return new DefaultKafkaProducerFactory(config);
    }

    @Bean
    public KafkaTemplate kafkaTemplate() {
        return new KafkaTemplate(producerConfig());
    }

 @Bean
    public ConcurrentKafkaListenerContainerFactory aaKafkaListenerFactory() {
        ConcurrentKafkaListenerContainerFactory<String, AssessmentAttemptDetailsEntity> factory = new ConcurrentKafkaListenerContainerFactory();
        factory.setConsumerFactory(assessmentAttemptDetailsEntityConsumerFactory());
        return factory;
    }
}

Answer 1

You can whitelist your package by changing assessmentAttemptDetailsEntityConsumerFactory() like this:

    @Bean
    public ConsumerFactory<String, AssessmentAttemptDetailsEntity> assessmentAttemptDetailsEntityConsumerFactory() {
            JsonDeserializer<AssessmentAttemptDetailsEntity> 
            deserializer = new JsonDeserializer<>();
            deserializer.addTrustedPackages("com.lte.assessment.assessments");//your package
        return new DefaultKafkaConsumerFactory(config,deserializer);
    }