{"record":{"id":"00cc50bea4cab094","repo":"nathanmarz/storm","slug":"could-not-find-a-authutils-login-context-server-entry-in","errorCode":null,"errorMessage":"Could not find a '${AuthUtils.LOGIN_CONTEXT_SERVER}' entry in this configuration: Server cannot start.","messagePattern":"Could not find a '(.+?)' entry in this configuration: Server cannot start\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"critical","filePath":"storm-core/src/jvm/backtype/storm/security/auth/digest/ServerCallbackHandler.java","lineNumber":54,"sourceCode":"\n/**\n * SASL server side collback handler\n */\npublic class ServerCallbackHandler implements CallbackHandler {\n    private static final String USER_PREFIX = \"user_\";\n    private static final Logger LOG = LoggerFactory.getLogger(ServerCallbackHandler.class);\n    private static final String SYSPROP_SUPER_PASSWORD = \"storm.SASLAuthenticationProvider.superPassword\";\n\n    private String userName;\n    private final Map<String,String> credentials = new HashMap<String,String>();\n\n    public ServerCallbackHandler(Configuration configuration) throws IOException {\n        if (configuration==null) return;\n\n        AppConfigurationEntry configurationEntries[] = configuration.getAppConfigurationEntry(AuthUtils.LOGIN_CONTEXT_SERVER);\n        if (configurationEntries == null) {\n            String errorMessage = \"Could not find a '\"+AuthUtils.LOGIN_CONTEXT_SERVER+\"' entry in this configuration: Server cannot start.\";\n            throw new IOException(errorMessage);\n        }\n        credentials.clear();\n        for(AppConfigurationEntry entry: configurationEntries) {\n            Map<String,?> options = entry.getOptions();\n            // Populate DIGEST-MD5 user -> password map with JAAS configuration entries from the \"Server\" section.\n            // Usernames are distinguished from other options by prefixing the username with a \"user_\" prefix.\n            for(Map.Entry<String, ?> pair : options.entrySet()) {\n                String key = pair.getKey();\n                if (key.startsWith(USER_PREFIX)) {\n                    String userName = key.substring(USER_PREFIX.length());\n                    credentials.put(userName,(String)pair.getValue());\n                }\n            }\n        }\n    }\n\n    public void handle(Callback[] callbacks) throws UnsupportedCallbackException {\n        for (Callback callback : callbacks) {","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/nathanmarz/storm/blob/cdb116e942666973bc4eaa0df098d5bab82739e7/storm-core/src/jvm/backtype/storm/security/auth/digest/ServerCallbackHandler.java#L36-L72","documentation":"ServerCallbackHandler implements the SASL server-side callbacks for Storm's DIGEST-MD5 digest authentication. It reads the JAAS configuration section named AuthUtils.LOGIN_CONTEXT_SERVER (\"Server\") and populates a user->password map from its options. When configuration.getAppConfigurationEntry(AuthUtils.LOGIN_CONTEXT_SERVER) returns null (no 'Server' section exists), it throws this IOException because the server cannot authenticate any client without its credential table.","triggerScenarios":"Constructing ServerCallbackHandler with a Configuration that contains no JAAS entry named 'Server' — e.g. the JAAS file loaded via -Djava.security.auth.login.config only defines a 'Client' section, or the server section is named differently (like 'StormServer') than AuthUtils.LOGIN_CONTEXT_SERVER.","commonSituations":"Nimbus/supervisor/ui startup with DigestMd5ClientTransportPlugin configured but jaas.conf missing the 'Server' block; reusing a zookeeper/kafka jaas.conf that lacks a Storm 'Server' section; section renamed during config migration; wrong file supplied on the master nodes.","solutions":["Add a 'Server { ... }' section to the JAAS file with user-prefixed credentials, e.g. Server { org.apache.storm.security.auth.digest.MD5DigestLoginModule required user_admin=\"secret\"; };","Confirm the section is exactly named 'Server' (case-sensitive match against AuthUtils.LOGIN_CONTEXT_SERVER).","Ensure every node running Nimbus/supervisor/ui loads the correct JAAS file via -Djava.security.auth.login.config in the master childopts.","If digest auth is undesired, revert storm.thrift.transport to a non-SASL transport (e.g. SimpleTransportPlugin)."],"exampleFix":"// jaas.conf before (client only)\nClient { com.myauth.MD5DigestLoginModule required username=\"admin\" password=\"secret\"; };\n// after\nClient { com.myauth.MD5DigestLoginModule required username=\"admin\" password=\"secret\"; };\nServer { com.myauth.MD5DigestLoginModule required user_admin=\"secret\"; };","handlingStrategy":"validation","validationCode":"Configuration jaas = Configuration.getConfiguration();\nif (jaas == null || jaas.getAppConfigurationEntry(\"Server\") == null) {\n    throw new IllegalStateException(\"JAAS config is missing the required 'Server' section\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Configuration c = Configuration.getConfiguration();\n    if (c.getAppConfigurationEntry(\"Server\") == null) {\n        throw new IllegalStateException(\"Server JAAS section missing before starting Nimbus/supervisor\");\n    }\n} catch (IOException e) {\n    throw new IllegalStateException(\"Failed to validate JAAS config: \" + e.getMessage(), e);\n}","preventionTips":["Include the 'Server' section with user_<name> password options whenever DigestMd5 auth is configured","Run a startup check on Nimbus/supervisor that verifies the JAAS 'Server' entry exists before accepting topology submissions","Do not reuse a foreign jaas.conf (Kafka/ZK) without adding the Storm 'Server' section","Distribute the same jaas.conf to all nodes via a config management tool"],"tags":["jaas","authentication","configuration","storm"],"backgroundTag":"missing-required-config","analyzedSha":"cdb116e942666973bc4eaa0df098d5bab82739e7","analyzedAt":"2026-09-12T14:30:00.714Z","contentChangedAt":"2026-09-12T14:30:00.714Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}