{"record":{"id":"80ecafe06db44e3e","repo":"spring-projects/spring-security","slug":"unknown-callback","errorCode":null,"errorMessage":"Unknown Callback","messagePattern":"Unknown Callback","errorType":"exception","errorClass":"UnsupportedCallbackException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java","lineNumber":362,"sourceCode":"\t\t\tthis.password = password;\n\t\t}\n\n\t\t@Override\n\t\tpublic void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {\n\n\t\t\tfor (Callback callback : callbacks) {\n\t\t\t\tif (callback instanceof NameCallback) {\n\t\t\t\t\tNameCallback nc = (NameCallback) callback;\n\t\t\t\t\tnc.setName(this.userPrincipal);\n\t\t\t\t}\n\t\t\t\telse if (callback instanceof PasswordCallback) {\n\t\t\t\t\tPasswordCallback pc = (PasswordCallback) callback;\n\t\t\t\t\tif (this.password != null) {\n\t\t\t\t\t\tpc.setPassword(this.password.toCharArray());\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\tthrow new UnsupportedCallbackException(callback, \"Unknown Callback\");\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":344,"sourceCodeEnd":370,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java#L344-L370","documentation":"KerberosRestTemplate's internal CallbackHandler supports only NameCallback and (when a password is configured) PasswordCallback, as required for the JAAS Krb5LoginModule. Any other JAAS callback type is rejected by throwing UnsupportedCallbackException with the message 'Unknown Callback'.","triggerScenarios":"JAAS login configuration (ClientLoginConfig) uses a LoginModule that invokes a callback type other than name/password — e.g. a TextInputCallback, ChoiceCallback, or custom callback — while authenticating via KerberosRestTemplate's password-based login.","commonSituations":"Custom JAAS LoginModule implementations plugged in via the KerberosRestTemplate configuration; debugging setups where a prompt-based module asks for interactive callbacks.","solutions":["Use the standard com.sun.security.auth.module.Krb5LoginModule, which only requires name/password callbacks.","If a custom LoginModule is required, restrict its callbacks to NameCallback/PasswordCallback.","Supply the password on KerberosRestTemplate so PasswordCallback can be answered (or use useTicketCache/keytab-based login)."],"exampleFix":"// before\nKerberosRestTemplate t = new KerberosRestTemplate(customLoginConfigModule, user, pass);\n// after\nKerberosRestTemplate t = new KerberosRestTemplate(keytabPath, userPrincipal); // keytab-based, no exotic callbacks","handlingStrategy":"try-catch","validationCode":"// ensure only standard Krb5LoginModule is configured\nboolean standard = \"com.sun.security.auth.module.Krb5LoginModule\".equals(loginModuleClassName);","typeGuard":null,"tryCatchPattern":"try {\n    return template.getForObject(url, String.class);\n} catch (Exception e) {\n    if (hasCause(e, UnsupportedCallbackException.class)) {\n        // fall back to keytab-based template\n    }\n    throw e;\n}","preventionTips":["Use com.sun.security.auth.module.Krb5LoginModule, not custom modules.","Prefer keytab-based KerberosRestTemplate over password callbacks.","Don't add interactive JAAS callbacks in server-side auth."],"tags":["java","kerberos","jaas","authentication","callback"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}