apache/hadoop · error · UnsupportedCallbackException

Unrecognized SASL GSSAPI Callback

Error message

Unrecognized SASL GSSAPI Callback

What it means

SaslGssCallbackHandler, the server-side Kerberos callback handler, accepts only AuthorizeCallback and throws UnsupportedCallbackException for anything else. The JDK's GSS-API normally sends exactly one AuthorizeCallback during SASL GSSAPI negotiation, so this message points to an unusual GSS implementation or an injected provider rather than ordinary configuration.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java:381

        final char[] password = name != null ? getPassword(name) : null;
        customizedCallbackHandler.handleCallbacks(unknownCallbacks, name, password);
      }
    }
  }

  /** CallbackHandler for SASL GSSAPI Kerberos mechanism */
  @InterfaceStability.Evolving
  public static class SaslGssCallbackHandler implements CallbackHandler {

    @Override
    public void handle(Callback[] callbacks) throws
        UnsupportedCallbackException {
      AuthorizeCallback ac = null;
      for (Callback callback : callbacks) {
        if (callback instanceof AuthorizeCallback) {
          ac = (AuthorizeCallback) callback;
        } else {
          throw new UnsupportedCallbackException(callback,
              "Unrecognized SASL GSSAPI Callback");
        }
      }
      if (ac != null) {
        String authid = ac.getAuthenticationID();
        String authzid = ac.getAuthorizationID();
        if (authid.equals(authzid)) {
          ac.setAuthorized(true);
        } else {
          ac.setAuthorized(false);
        }
        if (ac.isAuthorized()) {
          if (LOG.isDebugEnabled())
            LOG.debug("SASL server GSSAPI callback: setting "
                + "canonicalized client ID: " + authzid);
          ac.setAuthorizedID(authzid);
        }
      }

View on GitHub (pinned to 2add963021)

Solutions

1. Identify the callback class named in the exception and which GSS provider sent it
2. Switch the affected node to a stock OpenJDK distribution and retest the handshake
3. Remove custom JAAS/GSS modules from the login configuration
4. Align Hadoop and JDK versions across client and server nodes

try {
  saslServer = SaslRpcServer.create(connection, props, secretManager);
} catch (IOException e) {
  if (e.getCause() instanceof UnsupportedCallbackException) {
    // log callback class and JVM GSS provider details; fail handshake cleanly
  }
  throw e;
}

When it happens

Trigger: A JVM or JAAS login module whose GSS layer emits additional callback types during SASL GSSAPI negotiation on the server side of an RPC connection.

Common situations: Non-OpenJDK JVMs (e.g. older IBM J9 builds), custom JAAS login modules configured through java.security.auth.login.config, or JVM hardening that swaps the default GSS provider.

Related errors

• Server asks us to fall back to SIMPLE auth, but this client
• Client did not send a token
• Unrecognized SASL client callback
• Kerberos principal name does NOT have the expected hostname
• Kerberos required for secure registry access

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/8998e1798ea49712. Report an issue: GitHub.